A gateway receives an unexpired Entra token issued for a different API. Which two checks are necessary before granting sensitive access? Select 2 answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

A.Treat the APIM subscription key as the complete user identity
B.Remove backend authentication because token signature is valid
C.Validate required permissions or claims in addition to expiry
D.Validate the intended audience and trusted issuer
E.Accept any token signed by Entra regardless of audience

Show the answer and explanation

✓ Correct answers

Validate required permissions or claims in addition to expiry
Validate the intended audience and trusted issuer

Token validation must establish its intended API, issuer, lifetime, and authorization claims. A valid signature alone does not grant a different audience, subscription keys do not fully authenticate a sensitive user, and backend access remains protected. Source guide: PDF page(s) 52.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.