You are configuring policies for an API gateway in Azure API Management (APIM). The API gateway must meet the following requirements:
1. Restrict client request rates to a maximum of 100 calls per 60 seconds.
2. Remove a sensitive header named `X-Internal-Token` returned by the backend service before the response is sent back to the client.
Which two of the following policy configurations should you implement?
- Place the rate-limiting configuration within the inbound section:
xml
<inbound>
<base />
<rate-limit calls="100" renewal-period="60" />
</inbound>
Answer - BPlace the rate-limiting configuration within the outbound section:
xml
<outbound>
<base />
<rate-limit calls="100" renewal-period="60" />
</outbound> - Place the header deletion configuration within the outbound section:
xml
<outbound>
<base />
<set-header name="X-Internal-Token" exists-action="delete" />
</outbound>
Answer - DPlace the header deletion configuration within the inbound section:
xml
<inbound>
<base />
<set-header name="X-Internal-Token" exists-action="delete" />
</inbound>
Answer
The correct configurations are placing the rate-limit policy in the inbound section to throttle incoming requests, and placing the set-header policy with exists-action set to delete in the outbound section to remove the response header returned by the backend.
The rate-limit policy must be placed in the inbound section to intercept and throttle client requests before they are forwarded. The set-header policy with exists-action set to delete must be placed in the outbound section to remove the specified header from the backend response before returning it to the client.
Step-by-Step Solution
Key Concept
Azure API Management policies are executed sequentially across different sections (inbound, backend, outbound, on-error). Choosing the correct policy section is essential for routing, throttling, and modifying requests or responses.