nerdexam
Microsoft

AZ-204 · Question #358

We secured our function against unknown HTTP callers by requiring a function-specific API key be passed with each call. Which of the following fields is the name header in the HTTP requests that needs

The correct answer is A. x-functions-key. When securing an Azure Function with an API key, the key must be passed in the 'x-functions-key' HTTP header.

Submitted by rohit_dlh· Mar 30, 2026Implement Azure security

Question

We secured our function against unknown HTTP callers by requiring a function-specific API key be passed with each call. Which of the following fields is the name header in the HTTP requests that needs to contain this key?

Options

  • Ax-functions-key
  • Bx-requested-with
  • Cx-csrf-token

How the community answered

(17 responses)
  • A
    82% (14)
  • B
    12% (2)
  • C
    6% (1)

Why each option

When securing an Azure Function with an API key, the key must be passed in the 'x-functions-key' HTTP header.

Ax-functions-keyCorrect

Azure Functions uses the 'x-functions-key' HTTP header to transmit API keys for function-level authorization. When an API key is required, the caller must include this header with a valid key value for the function to execute successfully.

Bx-requested-with

'x-requested-with' is a non-standard HTTP header commonly used by JavaScript frameworks to identify AJAX requests.

Cx-csrf-token

'x-csrf-token' is typically used for Cross-Site Request Forgery (CSRF) protection in web applications.

Concept tested: Azure Function API key authentication header

Source: https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook-trigger?tabs=in-process%2Cfunctionsv2&pivots=programming-language-csharp#http-request-headers

Topics

#Azure Functions#API key#HTTP trigger security#function authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-204 Practice