AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A company exposes an internal REST API to external partners using Azure API Management. They need to enforce a rate limit of 100 requests per minute per subscription. Which policy should they add?
⚠ Common exam trap
Many candidates confuse the 'rate-limit' policy (per-subscription, fixed window) with the 'throttling' policy (rate-limit-by-key, per-key or per-identity), but the question's requirement for 'per subscription' directly maps to the rate-limit policy, not the throttling policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rate limit policy
The Rate limit policy (option B) is correct because it enforces a per-subscription key rate limit of 100 requests per minute, which is exactly what the scenario requires. Azure API Management's rate-limit policy counts requests against the specified duration and blocks additional calls once the limit is exceeded, returning a 429 Too Many Requests response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CORS policy
Why it's wrong here
The Cross-Origin Resource Sharing (CORS) policy is a browser-side security mechanism that dictates which web applications running at one origin are permitted to access resources from a different origin. It primarily involves checking HTTP headers like Origin and Access-Control-Allow-Origin to prevent unauthorized cross-origin requests. This policy is entirely focused on origin-based access control, not on limiting the number or frequency of API calls from an allowed origin.
- ✓
Rate limit policy
Why this is correct
The Rate limit policy in Azure API Management is specifically designed to restrict the number of API calls an individual consumer, identified by a subscription key or user ID, can make within a defined time window. This policy enforces fair usage and prevents abuse by rejecting requests that exceed the configured limit with an HTTP 429 Too Many Requests status. It is ideal for managing consumption per external partner, ensuring each partner adheres to their allocated quota.
- ✗
Throttling policy
Why it's wrong here
While often used interchangeably in general terms, a throttling policy in the context of Azure API Management typically refers to a global or product-level `limit-call-rate` policy. This policy sets an aggregate maximum for the total number of requests or bandwidth that the API gateway will process across all consumers, protecting the backend service from being overwhelmed. Unlike a rate limit, it does not differentiate between individual partners but rather safeguards the overall service capacity.
- ✗
Validate JWT policy
Why it's wrong here
The Validate JWT policy is a crucial security mechanism used to verify the authenticity and integrity of JSON Web Tokens presented in incoming API requests. It checks various aspects such as the token's signature, expiration time, issuer, and audience claims to ensure the request is legitimate and authorized. This policy is solely concerned with authentication and authorization, not with controlling the volume or frequency of requests made by a client.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.