The public API Management gateway still serves only the default *.azure-api.net host and allows a weak TLS version. What should the security engineer configure?
Select an answer to reveal the explanation.
Short Explanation
APIM needs its own custom domain, cert, and min TLS—same idea as any public gateway. Policy XML and subscription-key catalogs don’t harden the listener.
Full Explanation
For public TLS on API Management, configure a custom domain, bind a TLS certificate, and set the minimum TLS protocol on the gateway. Broader “recommend security configurations for APIM” catalogs (backend auth, named values, subscription keys) and inbound policy XML belong to other skills or developer work and do not replace hostname/TLS hardening. Disabling HTTPS weakens the public gateway.