You are securing several APIs hosted in Azure API Management and need to hide backend implementation details and technology stack across all APIs. Which policy and scope should you apply?

An outbound policy scoped to global is the correct choice because it applies to all APIs and processes responses before they are sent to the client. This allows you to modify or strip headers (like X-Powered-By or Server) that reveal backend implementation details across all your APIs consistently. An inbound policy processes requests before they reach the backend, so it cannot modify backend response headers. An outbound policy scoped to an operation would only apply to a single operation, not all APIs. A backend policy is applied to the communication between API Management and the backend service, not the response sent to the client, and is typically used for things like authentication to the backend.