Exam AZ-204 topic 4 question 14 discussion

C is correct.

A and D will send credential to the API. B is not meet the requirement. only C can be selected

Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication. They are automatically managed by Azure and enable you to authenticate to services that support Azure AD authentication, without needing to insert credentials into your code. In this case, a managed identity would meet both requirements: it would authenticate all API calls, and callers to the API would not need to send credentials because the authentication is handled automatically by Azure

C. Managed identity

Another pointless requirement made up with some answer in mind and it is impossible to guess what the Microsoft guy had in his mind at that point in time (of course nobody reviews relevance of the questions once created). The requirement that the credentials are not sent is weird. It depends on whether a client certificate is seen as a credential. That gets in conflict with whether the API is called from a client that does not have a managed identity. For example, from postman or curl or a Single Page Application. You cannot use Managed identity in that case. So, depending on how much an unfortunate question taker knows there is 50% chance (excuse my probability knowledge) that he can make a mistake or not. Microsoft guy wins

Tested it with a App Service running my C# code while using the Azure identity packages.

C is the correct answer.

Got this on 04/05/22 (selected Managed Identity)

Got it in exam 03/22

Question is about from APIM to other azure resource, C is correct managed identity. Question is NOT about how end users access APIM

got this in the exam :)

Managed identity only works for internal api calls. The requirement is "all api calls must be authenticated". Certificate would meet that requirement?

correct

D would work though, and it meets all the criteria (the private key of the certificate is never sent to the server during https handshake). If multiple answers are possible, I'd go for C and D, but if only one answer is possible, C is better for the reason stated in the answer explanation section.