AZ-204 Certification Practice Question #132

Question

You are a developer for a SaaS company that offers many web services.
All web services for the company must meet the following requirements:
✑ Use API Management to access the services
✑ Use OpenID Connect for authentication
✑ Prevent anonymous usage
A recent security audit found that several web services can be called without any authentication.
Which API Management policy should you implement?

Accepted Answer

OpenID Connect is an authentication protocol built on top of OAuth 2.0, which uses JSON Web Tokens (JWT) to transmit identity information securely. In Azure API Management, the `validate-jwt` policy is specifically designed to intercept incoming requests, extract the JWT, and validate its signature, expiration, and required claims against the configured identity provider (e.g., Microsoft Entra ID). This prevents anonymous usage and ensures that requests are properly authenticated. Other options like checking headers or certificates do not validate the OpenID Connect JWT tokens.

More AZ-204 practice questions