Your SaaS company exposes many web services and requires: access via API Management, OpenID Connect authentication, and no anonymous calls. A security audit found some services allow unauthenticated calls. Which API Management policy should you add to enforce OpenID Connect tokens and block anonymous requests?

The validate-jwt policy is the correct choice because it specifically enforces the presence and validity of a JSON Web Token (JWT), which is the standard token format used with OpenID Connect. This policy allows you to configure expected issuer, audience, and signing keys, ensuring that only tokens issued by your OpenID Connect provider are accepted. If a request does not contain a valid JWT, the policy will reject it, effectively blocking anonymous calls. The jsonp policy is for enabling JSON with Padding, a cross-domain communication technique, not for authentication. The authentication-certificate policy is used for client certificate authentication, not OpenID Connect tokens. The check-header policy can verify the existence or value of a header but lacks the cryptographic validation capabilities required for JWTs.