AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Which THREE are best practices for implementing an API using Azure API Management? (Choose three.)
⚠ Common exam trap
A common mix-up: candidates assume the Consumption tier is suitable for production APIs with custom domains, but it lacks custom domain support and other enterprise features, making it only appropriate for low-volume or development scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use policies to enforce throttling and quotas.
A is correct because Azure API Management policies allow you to enforce throttling and quotas at the API level, protecting your backend from excessive traffic. By defining rate limits and quota policies, you can control the number of requests a client can make within a specified time window, ensuring fair usage and preventing abuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use policies to enforce throttling and quotas.
Why this is correct
Azure API Management policies are XML-based configurations that can be applied at various scopes (global, product, API, operation). Throttling policies (e.g., `rate-limit-by-key`) prevent abuse by limiting the number of calls within a specified period, while quota policies (e.g., `quota-by-key`) restrict the total number of calls or bandwidth over a longer duration. These are crucial for protecting backend services from overload and ensuring fair usage among consumers.
- ✓
Implement caching policies to reduce backend load.
Why this is correct
API Management's caching policies (e.g., `cache-lookup`, `cache-store`) allow responses from backend services to be stored in API Management's internal cache for a configurable duration. This significantly reduces the number of requests that reach the actual backend, leading to lower latency for clients and decreased operational costs and resource consumption on the backend infrastructure. It's particularly effective for frequently accessed, non-volatile data.
- ✓
Use subscription keys for client authentication and rate limiting.
Why this is correct
Subscription keys, generated within Azure API Management, provide a straightforward mechanism for client identification. When a client makes a request, they include their unique subscription key in the request header (e.g., `Ocp-Apim-Subscription-Key`). This key is then used by API Management to authenticate the client against a specific product subscription and to apply associated usage policies, such as rate limits and quotas, ensuring controlled access and preventing unauthorized consumption.
- ✗
Use the Consumption tier for production APIs with custom domains.
Why it's wrong here
The Azure API Management Consumption tier is designed for serverless workloads and offers a pay-per-action billing model, making it cost-effective for intermittent or low-volume usage. However, a key limitation for production APIs requiring a professional presence is its lack of support for custom domains. Production environments typically demand custom domain names for branding and trust, which necessitates using higher tiers like Developer, Standard, or Premium.
- ✗
Expose the backend service URLs directly to clients.
Why it's wrong here
Directly exposing backend service URLs to clients completely circumvents the purpose of Azure API Management. This practice bypasses all the critical security, transformation, caching, and monitoring capabilities that API Management provides, such as authentication, authorization, rate limiting, request/response transformation, and analytics. It exposes the internal architecture, potentially leading to security vulnerabilities, uncontrolled access, and a lack of centralized management.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.