Implement API Management

Question 1

When are the rate-limit-by-key and quota-by-key policies not avaliable in Azure API Management?

Answer 1

When using the consumption tier

Question 2

How would you rate limit an IP to only 10 calls every minute?

Answer 2

rate-limit-by-key calls=”10”
renewal-period=”60”
counter-key=”@(context.Request.IpAddress)”

Question 3

What’s the difference between a rate limit and a quota?

Answer 3

A rate limit are usually used to protect against short and intense volume bursts.
Quotas are used for controlling call rates over a longer period of time.

E.g. have 10,000 requests per month, but if you were to make 5,000 in 1 minute would overwhelm the service so we limit it to a 10 a minute.
If we were to run 10 requests per minute we’d run out of our quota in 16 hours but our service wouldn’t go down.

Question 4

What PowerShell cmdlet would you use to create a new identity provider?

Answer 4

New-AzApiManagementIdentityProvider

Question 5

Which PowerShell cmdlet would you use to create a new API Management instance?

Answer 5

New-AzApiManagement

Question 6

Which PowerShell cmdlet would you use to create a new APIM API instance?

Answer 6

New-AzApiManagementApi

Question 7

When an API has reached it’s usage quota what will the response be?

Answer 7

403 Forbidden

Question 8

What response will an API return if it’s reached its limit of call rates?

Answer 8

429 Too Many Requests

Question 9

Before an API can be consumed through a APIM what must be done first?

Answer 9

Added to a product in the Azure portal

Question 10

When wanting to test changes of an API without publishing what should you do?

Answer 10

Create a revision.

Question 11

What Powershell commandlet would you use to create an API Management Service? And then show it?

Answer 11

New-AzApiManagement -Name “myapim” -ResourceGroupName “myResourceGroup” `
-Location “West US” -Organization “Contoso” -AdminEmail “admin@contoso.com”

Get-AzApiManagement -Name “myapim” -ResourceGroupName “myResourceGroup”

Question 12

What Azure CLI command would you use to create a new API Management Service? And then show the result

Answer 12

az apim create –name myapim –resource-group myResourceGroup \

• -publisher-name Contoso –publisher-email admin@contoso.com \
• -no-wait

az apim show –name myapim –resource-group myResourceGroup –output table

Question 13

What xml snippet would be used for adding the header ‘Forwarded’ with the value of the host?

Answer 13

@(“host=” + context.Request.OriginalUrl.Host + “;”)

Question 14

What do the four different API policies mean?

• inbound
• backend
• outbound
• on-error

Answer 14

< policies>
< inbound>
< !– statements to be applied to the request go here –>
< /inbound>
< backend>
< !– statements to be applied before the request is forwarded to
the backend service go here –>
< /backend>
< outbound>
< !– statements to be applied to the response go here –>
< /outbound>
< on-error>
< !– statements to be applied if there is an error condition go here –>
< /on-error>< /policies>

Question 15

What policy statement should you add to authenticate with basic auth?

Answer 15

< authentication-basic username=”username” password=”password” />

Question 16

What snippet would you use to authenticate with a backend service using a client certificate?

Answer 16

< authentication-certificate thumbprint=”thumbprint” certificate-id=”resource name”/>

Question 17

What do you need to be careful of when rotating a key vault certificate if using it for client certificate authentication?

Answer 17

The thumbprint in API management will change, and the policy will not resolve the new certificate if it is identified by it’s thumbprint

Question 18

What snippet would you use to authenticate with managed identity ?

Answer 18

< authentication-managed-identity resource=”resource” client-id=”clientid of user-assigned identity” output-token-variable-name=”token-variable” ignore-error=”true|false”/>

Question 19

What identity will be used when using managed identity if client-id is not provided?

Answer 19

The system-assigned identity

Question 20

What are the three subscriptions scopes for API management?

Answer 20

All APIs
Applies to every API accessible from the gateway.

Single API
Applies to a single imported API and all of its endpoints.

Product
A product is a collection of one or more APIs that you configure in APIM. You can assign APIs to more than one product. Products can have different access rules, usage quotas, and terms of use.

Question 21

What two tags would you need to add to cache an API result for 20 seconds?

Answer 21

< cache-lookup >
    < vary-by-header>Accept
    < vary-by-header>Accept-Charset
    < vary-by-header>Authorization
< /cache-lookup>

< cache-store duration=”20” />

Question 22

What unit is the renewal-period for rate limiting set as? E.g. restricitng a user via IP to an API

Answer 22

Seconds