A fern-gully CORS header is required on one APIM operation, not the whole instance. At which policy scope should the developer apply it?
Select an answer to reveal the explanation.
Short Explanation
Don’t paint the whole house for one door. Apply the CORS policy at operation scope—APIM scopes (global, product, API, operation) let the more specific setting win.
Full Explanation
API Management policies attach at global, product, API, and operation scopes (workspace scopes may also apply). When a fern-gully CORS header is required on one operation only, apply the policy at operation scope. More specific scopes override broader ones, so a single-operation setting does not force every API on the instance to inherit that header forever.
Applying the policy only at global (all APIs) scope fails least-blast-radius intent: every operation would inherit the header, which is the opposite of “one operation, not the whole instance.”
Putting the setting inside an AKS Ingress annotation because “APIM has no scopes” fails factually—APIM has a clear scope hierarchy—and Ingress annotations do not configure APIM operation policies.
Storing a Key Vault secret named cors-header with no gateway policy fails because Key Vault holds secrets; it does not emit Access-Control headers unless some policy or app code reads the secret and applies CORS, which this distractor explicitly omits.
Exam caveat: if both API-scope and operation-scope policies exist, understand override and inheritance rules for the sections you edit so you do not accidentally widen CORS. Operational check: set the cors (or header) policy on the single operation, call that operation and a sibling operation, and confirm only the intended operation returns the municipal CORS header.