AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Your company uses Azure API Management to manage APIs. You need to implement policies that ensure only authenticated requests from partners are allowed, and that responses are cached to improve performance. Which THREE policies should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse caching policies (cache-store, cache-lookup) with other performance-related policies like rate-limit or set-header, failing to recognize that caching requires a specific pair of policies to function correctly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
cache-store
(cache-store) is correct because it is part of the caching policy in Azure API Management. When combined with cache-lookup, it stores the response in the internal or external cache after the backend has processed the request, reducing latency and backend load for subsequent identical requests. This directly supports the requirement to improve performance by caching responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
set-header
Why it's wrong here
The set-header policy is used to manipulate HTTP headers for both incoming requests and outgoing responses within Azure API Management. Its functionality is limited to adding, modifying, or removing header fields, which is useful for tasks like injecting correlation IDs, setting content types, or transforming existing headers. However, it does not provide any mechanisms for authentication, such as validating tokens, nor does it participate in the caching of API responses.
- ✗
rate-limit
Why it's wrong here
The rate-limit policy in Azure API Management is implemented to control the frequency at which a client or user can invoke an API within a defined time window. Its primary purpose is to protect backend services from being overwhelmed by excessive requests, ensuring fair usage and preventing denial-of-service attacks. This policy is solely focused on traffic management and has no direct role in authenticating API consumers or in caching API responses for performance optimization.
- ✓
cache-store
Why this is correct
The cache-store policy in Azure API Management is specifically designed to take the current response from the backend service and store it within the API Management's internal cache. This policy is typically executed after a successful backend call, especially when a preceding cache-lookup policy indicates a cache miss. By storing the response for a specified duration, subsequent identical requests can be served directly from the cache, significantly reducing latency and the load on the backend API.
- ✓
validate-jwt
Why this is correct
The validate-jwt policy is a crucial security mechanism within Azure API Management, enabling the enforcement of authentication by verifying JSON Web Tokens (JWTs) presented in API requests. It performs comprehensive checks, including validating the token's signature against a specified key, ensuring its expiration time has not passed, and verifying the audience and issuer claims. This policy is fundamental for securing APIs that rely on token-based authentication, ensuring only authorized requests proceed.
- ✓
cache-lookup
Why this is correct
The cache-lookup policy is utilized in Azure API Management to determine if a valid, cached response for the current request already exists. When this policy is executed, it queries the API Management's internal cache using a generated cache key. If a matching and unexpired response is found, it is immediately returned to the client, bypassing the backend API entirely. This significantly improves API response times and reduces the operational load on the backend services.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.