Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You manage an API in Azure API Management. You need to enforce a rate limit of 200 requests per minute for each subscription key. Which policy should you include in the inbound policy section?
⚠ Common exam trap
Candidates often confuse <rate-limit> with <quota>, as both control request volume, but <quota> applies to total counts over days/months, not per-minute rate limiting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
<rate-limit> policy
The <rate-limit> policy in Azure API Management is specifically designed to enforce a per-subscription key rate limit, such as 200 requests per minute. It operates on a sliding window counter to smooth traffic and is applied in the inbound section to evaluate each request before it reaches the backend. This matches the requirement exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
<rate-limit> policy
Why this is correct
The <rate-limit> policy is designed to restrict the number of API calls a client can make within a specified short time interval, such as per minute or per second. It operates using a sliding window mechanism, continuously evaluating the call count against the defined limit. This policy is crucial for preventing bursts of traffic, protecting backend services from overload, and ensuring fair usage across consumers by enforcing immediate call rate constraints.
- ✗
<quota> policy
Why it's wrong here
The <quota> policy differs from rate limiting by setting an aggregate limit on the total number of calls or total bandwidth consumed over a much longer duration, such as a day, week, or month. Unlike rate limits that control instantaneous traffic, quotas are typically used for managing long-term consumption, often tied to billing tiers or subscription allowances. It does not directly control the rate of calls within a short window but rather the overall volume over an extended period.
- ✗
<limit-concurrency> policy
Why it's wrong here
The <limit-concurrency> policy specifically restricts the maximum number of simultaneous, active requests that a client or scope can have in progress at any given moment. This policy is distinct from rate limiting, which focuses on the count of requests over a time period, as it targets the parallel execution of calls. Its primary purpose is to prevent backend systems from being overwhelmed by too many concurrent operations, which could lead to resource exhaustion or performance degradation.
- ✗
<throttle> policy
Why it's wrong here
The <throttle> policy is not a valid or recognized policy name within Azure API Management. While "throttling" is a general term often used to describe the act of limiting API requests, the specific policy names implemented in Azure API Management for this functionality are <rate-limit> for controlling call rates over short intervals and <quota> for managing total consumption over longer periods. Using an incorrect policy name will result in a deployment error.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.