AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Which THREE features of Azure API Management help enforce security policies for APIs? (Choose three.)
⚠ Common exam trap
Test-takers frequently confuse transformation or caching policies (like xml-to-json or cache-lookup) with security policies, but Azure API Management clearly categorizes security policies as those that control access, authenticate, or throttle traffic, not those that modify data or improve performance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
rate-limit policy
The rate-limit policy (A) is correct because it enforces security by throttling API calls to prevent abuse and denial-of-service attacks, limiting the number of requests within a specified time window per subscription or key. This protects backend services from being overwhelmed by excessive traffic, a core security requirement for API management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
rate-limit policy
Why this is correct
The `rate-limit` policy is a critical security feature in Azure API Management designed to prevent API abuse, Denial of Service (DoS) attacks, and brute-force attempts. It enforces a maximum number of API calls a client or subscription can make within a specified time window, ensuring fair usage and protecting backend services from being overwhelmed by excessive requests. By controlling the request volume, this policy helps maintain API availability and stability, which are fundamental aspects of overall API security.
- ✗
xml-to-json policy
Why it's wrong here
The `xml-to-json` policy serves a purely functional role within Azure API Management, primarily focused on data transformation. Its purpose is to convert request or response payloads from XML format to JSON format, facilitating interoperability and ease of consumption for various client applications. This policy does not implement any security controls such as authentication, authorization, access restriction, or threat protection, and therefore does not contribute to enforcing API security.
- ✗
cache-lookup policy
Why it's wrong here
The `cache-lookup` policy is an optimization feature in Azure API Management aimed at improving API performance and reducing the load on backend services. By storing and retrieving API responses from a cache, it minimizes redundant calls to the backend. While caching can indirectly enhance resilience by offloading backend systems, it does not provide direct security enforcement mechanisms like access control, identity validation, or threat mitigation, making it unrelated to enforcing API security.
- ✓
validate-jwt policy
Why this is correct
The `validate-jwt` policy is a robust security mechanism that enforces authentication and authorization by verifying JSON Web Tokens (JWTs) presented by client applications. It meticulously checks the token's signature, expiration, audience, and issuer against predefined configurations, ensuring that only requests accompanied by valid, untampered, and trusted tokens are permitted to access the backend API. This policy is essential for implementing secure access control and user authentication flows.
- ✓
IP filtering policy
Why this is correct
The IP filtering policy, often implemented using `ip-filter` or `check-header` policies combined with IP address validation, provides a foundational network-level security layer. It explicitly allows or denies access to the API based on the source IP address of the incoming request. This is highly effective for restricting API consumption to known, trusted networks, specific client applications, or internal systems, thereby significantly reducing the attack surface and preventing unauthorized access from untrusted locations.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.