Task 4.2: Design solutions for securing applications

• AA penetration test after the API goes into production

  Incorrect

  Testing after release finds issues when they're most expensive to fix.

• BA web application firewall in front of the API, instead of a design review, because it blocks the most common attacks automatically

  Incorrect

  A WAF filters requests but doesn't find design-level threats.

• CA design-time threat model built with the Threat Modeling Tool, using STRIDE

  Correct

  The tool helps architects find design issues early, while they're cheap to fix, and analyzes each element with STRIDE.

• DA code coverage target of 90 percent for unit tests

  Incorrect

  Coverage measures testing breadth, not threats.

The Microsoft Threat Modeling Tool lets architects identify and mitigate potential security issues early, when they're relatively easy and cost-effective to resolve, by drawing the system's data flows and analyzing each element with STRIDE.

• ASubscription keys alone with a longer key length

  Incorrect

  Keys identify a subscription but aren't OAuth authorization.

• BThe validate-jwt policy for Entra tokens and rate-limit-by-key per client

  Correct

  validate-jwt enforces valid tokens at the gateway, and rate-limit-by-key throttles each caller separately.

• CA WAF custom rule that blocks the partner's IP address

  Incorrect

  Blocking an IP stops the partner entirely rather than throttling or authorizing.

• DKeep subscription keys and add Front Door WAF rate limiting rules that count requests per partner IP address

  Incorrect

  Rate limiting can throttle each client IP address, but it doesn't authorize calls with Entra-issued OAuth tokens.

In API Management, the validate-jwt policy enforces the existence and validity of a JSON web token, such as an OAuth 2.0 access token issued by Microsoft Entra ID. The rate-limit-by-key policy prevents API usage spikes on a per-key basis, for example per client ID or IP address.

• AKeep Front Door Standard and write custom rules for every OWASP attack

  Incorrect

  Standard supports only custom rules, which can't replace the managed rule sets.

• BApplication Gateway WAF in each region only

  Incorrect

  Regional gateways inspect traffic after it reaches each region, not at the global edge.

• CNetwork security groups on the web servers

  Incorrect

  NSGs don't inspect HTTP requests for application attacks.

• DAzure WAF on Front Door Premium with the managed Default Rule Set and bot protection

  Correct

  WAF on Front Door Premium has full capabilities, including managed rules and bot protection, at the edge.

Azure Web Application Firewall on Azure Front Door is a global, centralized solution deployed at edge locations, inspecting requests before they enter your network. It's natively integrated with Front Door Premium with full capabilities, such as managed rule sets and bot protection; for Front Door Standard, only custom rules are supported.

• ABuilt-in Azure Policy definitions for API Management, assigned at the management group

  Incorrect

  These policies audit how API Management services are configured; they don't inventory each API or detect attacks against it.

• BDefender for App Service

  Incorrect

  That plan protects App Service apps, not the API Management API inventory.

• CAzure Monitor metrics for API Management

  Incorrect

  Metrics show usage and performance, not security findings.

• DDefender for APIs in Microsoft Defender for Cloud

  Correct

  It inventories APIs published in API Management, flags external, unused and unauthenticated APIs, and detects threats.

Defender for APIs gives visibility into business-critical APIs published in Azure API Management: an inventory of managed APIs, security findings such as external, unused or unauthenticated APIs, posture recommendations, and detection of active real-time threats.

• ARansomware

  Incorrect

  Ransomware isn't a STRIDE category.

• BReplication

  Incorrect

  Replication isn't a STRIDE category.

• CRepudiation

  Correct

  R is repudiation: denying an action without others being able to prove otherwise.

• DRecoverability

  Incorrect

  Recoverability isn't a STRIDE category.

STRIDE classifies threats as spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.

• AA 200 response with an empty page

  Incorrect

  Blocked requests don't succeed.

• BA redirect to the Azure portal sign-in page

  Incorrect

  There's no portal redirect.

• CA 403 response, and the connection is closed

  Correct

  Blocked requests get a "403 unauthorized access" exception and the connection closes.

• DAn email that explains the block

  Incorrect

  Clients aren't emailed.

In Prevention mode, Application Gateway WAF blocks intrusions and attacks that its rules detect. The attacker receives a "403 unauthorized access" exception, the connection is closed, and the attack is recorded in the WAF logs.

• AThe Cloud Adoption Framework's Manage methodology

  Incorrect

  That methodology is about operating cloud estates, not building software.

• BThe Security Development Lifecycle (SDL)

  Correct

  The SDL's five core phases are requirements, design, implementation, verification and release, supported by training and response.

• CMicrosoft Secure Score

  Incorrect

  Secure Score measures security posture; it isn't a development process.

• DThe Zero Trust adoption framework's business scenarios

  Incorrect

  Those frame Zero Trust adoption for business leaders.

Microsoft's Security Development Lifecycle embeds security requirements, technology-specific tooling and mandatory processes into the development and operation of software. It has five core phases (requirements, design, implementation, verification and release), each with mandatory checks and approvals, plus two supporting activities: training before and response after the core phases.

• ASend the backend's admin password in a header

  Incorrect

  Passwords in headers aren't certificate authentication.

• BDisable TLS between the gateway and the backend

  Incorrect

  That removes transport security.

• CUse a mock response policy for every operation instead of calling the backend at all

  Incorrect

  Mocks don't reach the backend.

• DConfigure client certificate authentication to the backend

  Correct

  API Management can secure backend calls with client certificates (mutual TLS).

API Management can secure access to a backend service of an API by using client certificates and mutual TLS authentication, presenting a certificate that the backend validates.