Question 398 of 724
DVA-C02 Development with AWS Services Practice Question
A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API must support request validation, request throttling, and API keys. Which API Gateway feature should the developer use to enforce a daily request limit for each API key?
⚠ Common exam trap
It's easy for candidates to confuse API keys with usage plans, thinking that simply enabling API keys automatically enforces throttling or quotas, but API keys alone provide no rate limiting without a usage plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Usage plans
Usage plans in API Gateway allow you to set throttling and quota limits per API key, enabling daily request limits for each key. This feature is specifically designed to control usage by associating API keys with a plan that defines rate limits and quotas, such as a daily request cap. Option A is correct because it directly addresses the requirement to enforce a daily request limit per API key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Usage plans
Why this is correct
Usage plans in Amazon API Gateway are the definitive mechanism for enforcing per-client quotas and throttling limits. They allow you to associate specific API keys with defined request rates (e.g., requests per second) and burst capacities, as well as total request quotas over a given period. This ensures that individual API consumers adhere to their subscribed service tiers, preventing any single client from monopolizing API resources and providing granular control over API consumption.
- ✗
API keys
Why it's wrong here
API keys serve primarily as unique identifiers for API clients, enabling API Gateway to track and differentiate requests originating from various consumers. While essential for associating requests with a specific client, API keys themselves do not inherently enforce any rate limits or usage quotas. Their function is to provide the necessary client context for other features, like usage plans, to then apply specific access policies or consumption restrictions.
- ✗
Throttling settings at the method level
Why it's wrong here
Method-level throttling settings in API Gateway are designed to protect the backend service from being overwhelmed by an aggregate volume of requests, applying a uniform limit across all incoming traffic for a specific method or stage. These settings establish a maximum request rate and burst capacity that applies universally, regardless of the client making the request or their associated API key. Consequently, they cannot differentiate between individual clients to enforce per-user quotas or tiered access.
- ✗
AWS WAF
Why it's wrong here
AWS WAF (Web Application Firewall) is a security service that helps protect web applications and APIs from common web exploits and malicious traffic, such as SQL injection, cross-site scripting (XSS), and DDoS attacks. Its primary role is to filter and block harmful requests based on predefined or custom rules, safeguarding the integrity and availability of the API. WAF is not designed for managing or enforcing business-level quotas or rate limits tied to individual API keys or usage plans.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.