Practice Exam

Explanations for each answer:

• Configure and apply a new backend policy scoped to global is incorrect. Backend policies control how requests are forwarded to backend services (using policies like set-backend-service or forward-request) but don't modify response headers or content sent to clients. To hide backend information like server headers or technology stack details in responses, you need outbound policies that transform the response before it reaches the client, not backend policies.
• Configure and apply a new outbound policy scoped to the operation is incorrect. While outbound policies can hide backend information by removing or modifying response headers, scoping to the operation level would require applying the policy to every single operation across all APIs. This creates maintenance overhead and risks inconsistent protection if new operations are added. For protecting all APIs uniformly, global scope is more appropriate and efficient.
• Configure and apply a new inbound policy scoped to a product is incorrect. Inbound policies process requests before they reach the backend service, allowing you to validate, transform, or authenticate incoming requests. However, hiding backend information requires modifying responses after the backend processes them. You need outbound policies that execute after the backend returns data, not inbound policies that run before the request is forwarded.
• Configure and apply a new outbound policy scoped to global is correct. Outbound policies execute after the backend processes requests and before responses are sent to clients, making them ideal for hiding backend information. Scoping to global ensures the policy applies to all APIs and operations automatically, providing consistent protection. You can use policies like set-header to remove server headers (X-Powered-By, Server) or set-body to transform responses, obscuring the technology stack used by backend services.