You expose a back-end web service through Azure API Management. The back-end enforces HSTS and requires every request to include a valid HTTP Authorization header. Which two API Management authentication policies can you apply to supply credentials to the back-end? (Pick two.)

Basic Authentication and Certificate Authentication are the correct choices because they are direct methods for API Management to supply credentials to a backend service. Basic Authentication sends a username and password in the Authorization header, fulfilling the requirement for a valid HTTP Authorization header. Certificate Authentication uses a client certificate to authenticate with the backend, which is also a common and robust method for providing credentials. Digest Authentication is a challenge-response protocol that is less common for service-to-service authentication in modern APIs and doesn't directly fit the "supply credentials" requirement in the same way. OAuth Client Credential Grant is an authorization flow, not an authentication policy that API Management uses to authenticate itself to a backend service directly with credentials like a username/password or certificate. While API Management can act as an OAuth client, the policy itself doesn't directly "supply credentials" in the same manner as Basic or Certificate authentication for the backend.