Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: APIM rate-limit-by-key policy for per-subscriber…
Backend APIs exposed through Azure API Management are consumed by multiple subscribers. The product owner wants to prevent any single subscriber from sending more than 100 requests per minute, while allowing subscribers with heavier plans to have higher limits configured separately. Which APIM policy implements per-subscriber rate limiting?
⚠ Common exam trap
Many exam-takers confuse the `quota` policy (which sets a total limit shared across all subscribers of a product) with the `rate-limit-by-key` policy (which enforces per-subscriber limits), leading candidates to pick Option B when they see 'product' and 'per minute' without recognizing the shared vs. individual distinction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the rate-limit-by-key policy using the subscription key as the counter key, with calls set to 100 and renewal-period to 60
The `rate-limit-by-key` policy in Azure API Management enforces a per-key rate limit, and using the subscription key as the counter key ensures each subscriber is limited individually. The `calls` parameter set to 100 and `renewal-period` to 60 seconds matches the requirement of 100 requests per minute per subscriber, while allowing different limits for different plans by applying separate policies with different call counts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply the rate-limit-by-key policy using the subscription key as the counter key, with calls set to 100 and renewal-period to 60
Why this is correct
rate-limit-by-key with counter-key='@(context.Subscription.Id)' (or the subscription key header) creates a separate 100-calls/60-second counter per subscriber. When a subscriber's counter reaches 100, APIM returns 429 Too Many Requests for that subscriber while other subscribers continue at full rate.
- ✗
Apply the quota policy to the product with a total of 100 calls per minute shared across all subscribers
Why it's wrong here
The quota policy enforces a cumulative call limit across all subscribers of the product. If one subscriber uses 90 calls, only 10 remain for all others in that minute. This is a global cap, not a per-subscriber limit.
- ✗
Apply an ip-filter policy that blocks IP addresses making more than 100 requests per minute
Why it's wrong here
ip-filter allows or denies requests from specific IP ranges — it is an access control policy, not a rate-limiting policy. It cannot count requests per minute and cannot distinguish between subscribers sharing the same egress IP.
- ✗
Configure a backend circuit breaker policy to return cached responses after 100 calls
Why it's wrong here
Circuit breaker policies detect backend failures and open the circuit to prevent cascading failures — they are not rate-limiting mechanisms. Returning cached responses after 100 calls would change response content, not enforce a per-subscriber call limit.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.