Azure API Management still presents a username and password from a named value when calling the canal backend. What should the security engineer recommend?
Select an answer to reveal the explanation.
Short Explanation
Stop mailing the backend the canal password. Let APIM show up as itself with a managed identity—and if a secret must linger, pull it from Key Vault, don’t paste it into named values.
Full Explanation
Recommended APIM backend authentication uses a managed identity (authentication-managed-identity) so the gateway obtains tokens for the backend without embedding passwords in configuration. When secrets remain unavoidable, named values should reference Key Vault rather than hardcoded credentials. Custom-domain TLS configuration is a separate networking concern. Administering Key Vault access policies in depth belongs to Domain 4; this item focuses on the APIM recommendation.