You are writing a .NET Azure Function that validates Azure AD JWT access tokens for your custom API. The API is single-tenant and uses the v2.0 endpoint. Which validations should you implement to ensure tokens are accepted only if issued for your API by your tenant and are not expired or tampered with? Select three answers.

To ensure tokens are issued for your API by your tenant and are not expired or tampered with, you must validate the aud (audience) claim against your API's Application ID URI. This confirms the token is intended for your specific API. You must also retrieve the OpenID Connect metadata from your tenant's v2.0 endpoint to obtain the jwksuri, which provides the public keys necessary to validate the token's signature. This cryptographic check verifies the token's integrity and authenticity. Finally, enforce token lifetime by checking the exp (expiration) claim, allowing for a small clock skew to accommodate minor time differences between systems. The option to treat tokens issued for any tenant as valid is incorrect because it bypasses crucial security checks for single-tenant applications, allowing tokens from other tenants to be accepted. Issuer validation is not optional for secure applications.