A quince-hedge origin API has no authentication of its own. How should API Management keep anonymous internet calls from reaching that origin?
Select an answer to reveal the explanation.
Short Explanation
Origin has no auth? Enforce it on the gateway—subscription key, JWT, or certificate—so quince-hedge never sees anonymous strangers.
Full Explanation
If the quince-hedge origin API has no authentication of its own, enforce access at the API Management gateway: require a subscription key, validate a JWT, or enforce client certificates (alone or combined per policy) so unauthenticated internet calls never reach the origin. The facade becomes the authentication boundary the backend lacks, which is a common pattern when wrapping legacy or internal municipal services.
Opening the backend NSG to the entire Internet and relying on obscurity invites anonymous abuse and scans. Disabling the APIM gateway and publishing the origin hostname removes the control point entirely and advertises the unprotected service. Logging caller IP addresses only in Application Insights observes traffic after the fact for forensics; it does not block unauthenticated requests at the edge before they hit the origin.
Exam caveat: gateway auth protects weak or auth-less origins, but defense in depth still prefers locking down the backend network so only the gateway subnet or private endpoint path can reach quince-hedge.
Operational check: configure subscription-key or validate-jwt (or certificate) policies on the API, attempt a call without credentials and confirm rejection at APIM, succeed with valid credentials, and restrict origin network access to the gateway where the platform allows.