Azure API Management

Practice questions

1. Question 1Q-715C95

   An API is published through Azure API Management with subscription enforcement enabled. Which HTTP header should a client normally send to authenticate its subscription when calling the API?

   1. A.Ocp-Apim-Subscription-Key
   2. B.Ocp-Apim-Backend-Key
   3. C.X-Azure-Resource-Token
   4. D.Authorization-Subscription
   See the answer and solution
2. Question 2Q-15388D

   An API Management administrator wants to allow each subscription to make at most 100 calls every 60 seconds. Calls exceeding the limit should be rejected by the gateway. Which inbound policy statement meets this requirement?

   1. A.<rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Subscription.Id)" />
   2. B.<quota-by-key calls="100" renewal-period="60" counter-key="@(context.Subscription.Id)" />
   3. C.<validate-jwt header-name="Authorization" failed-validation-httpcode="429" />
   4. D.<set-header name="X-Rate-Limit" exists-action="override"><value>100</value></set-header>
   See the answer and solution
3. Question 3Q-7BE7E9

   A company exposes a customer API through Azure API Management. The company must introduce a breaking contract change while continuing to support existing clients that use version 1. Which API Management design is most appropriate?

   1. A.Create version 2 in the same API version set, select a versioning scheme such as URL path, and keep version 1 available.
   2. B.Create a revision of version 1 and publish only the latest revision as the replacement for all clients.
   3. C.Create a separate product for version 2 and rely on the product name to route requests to the new contract.
   4. D.Change the backend URL for version 1 so that it points to the implementation of version 2.
   See the answer and solution
4. Question 4Q-09FDB3

   An Azure API Management API has a backend service configured at https://api.contoso.com. One operation must instead send requests to https://orders.contoso.com/v2/orders without changing the backend used by other operations. Which policy should be added to that operation's inbound processing?

   1. A.set-backend-service with the service-url set to https://orders.contoso.com/v2
   2. B.rewrite-uri with the template set to https://orders.contoso.com/v2
   3. C.set-header with the header name Host and value orders.contoso.com
   4. D.set-method with the method set to POST
   See the answer and solution
5. Question 5Q-3B2064

   An API Management policy must add a payment-provider secret to an outbound request. The secret must not be stored as plaintext in the policy or exposed to API developers. Which approach best meets this requirement?

   1. A.Store the secret in an Azure Key Vault-backed named value and reference it in the policy as {{payment-provider-secret}}
   2. B.Store the secret in a URL query parameter and mark the API operation as internal
   3. C.Store the secret in the API description and obfuscate the value with Base64
   4. D.Store the secret in a request header policy as a literal value and restrict access to the developer portal
   See the answer and solution