A quince-hedge origin API has no authentication of its own. How should API Management keep anonymous internet calls from reaching that origin?
Select an answer to reveal the explanation.
Short Explanation
Origin has no auth? Enforce it on the gateway—subscription key, JWT, or certificate—so quince-hedge never sees anonymous strangers.
Full Explanation
API Management can require subscription keys, validate JWTs, or enforce client certificates before forwarding to a backend. That gateway-enforced access model protects origins that lack their own auth. Opening NSGs widely, disabling the gateway, or only logging callers does not block unauthenticated traffic at the facade.