AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Your company uses Azure API Management to expose APIs to external partners. You need to enforce throttling limits per subscription key. Which policy should you add?
⚠ Common exam trap
It's easy for candidates to confuse the `rate-limit` policy (global) with `rate-limit by key` (scoped), leading candidates to pick Option B without realizing it lacks the per-subscription granularity required by the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
rate-limit by key policy with @(context.Subscription.Id) as counter key
The `rate-limit by key` policy in Azure API Management allows you to enforce throttling limits based on a specific counter key. Using `@(context.Subscription.Id)` as the counter key ensures that each subscription key is tracked individually, enabling per-subscription throttling as required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
rate-limit by key policy with @(context.Subscription.Id) as counter key
Why this is correct
The `rate-limit by key` policy in Azure API Management is the correct choice for applying throttling based on specific caller identifiers. By using `@(context.Subscription.Id)` as the counter key, the policy effectively tracks and limits the number of requests originating from each unique API subscription. This ensures that each subscriber adheres to their allocated quota, preventing any single subscription from monopolizing API resources and maintaining service stability.
- ✗
rate-limit policy with IP address filtering
Why it's wrong here
The generic `rate-limit` policy, especially when combined with IP address filtering, is unsuitable for enforcing per-subscription request limits. IP addresses are often shared among multiple subscribers (e.g., behind a NAT gateway) or can change for a single subscriber, making them an unreliable identifier for consistent subscription-based throttling. This approach would fail to accurately attribute requests to individual subscriptions, leading to unfair or ineffective rate limiting across your API consumers.
- ✗
rate-limit by key policy with no counter key
Why it's wrong here
The `rate-limit by key` policy fundamentally requires a `counter-key` expression to identify the specific entity being throttled. Omitting this crucial attribute would render the policy ineffective, as it would lack the necessary context to differentiate between callers and maintain separate request counts. Consequently, the policy would either fail to apply correctly or inadvertently enforce a global limit across all requests, defeating the purpose of granular, per-key throttling.
- ✗
validate-jwt policy with claims check
Why it's wrong here
The `validate-jwt` policy is designed exclusively for authenticating and authorizing API requests by verifying the integrity and claims within a JSON Web Token. While essential for security by confirming identity and permissions, this policy does not possess any functionality for controlling the volume or frequency of requests made by an authenticated user. Its purpose is to establish trust and access rights, not to enforce throttling or usage quotas.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.