You are configuring policies for an API gateway in Azure API Management (APIM). The API gateway must meet the following requirements:
1. Restrict client request rates to a maximum of 100 calls per 60 seconds.
2. Remove a sensitive header named `X-Internal-Token` returned by the backend service before the response is sent back to the client.
Which two of the following policy configurations should you implement?
- Place the rate-limiting configuration within the inbound section:
xml
<inbound>
<base />
<rate-limit calls="100" renewal-period="60" />
</inbound>
Cevap - BPlace the rate-limiting configuration within the outbound section:
xml
<outbound>
<base />
<rate-limit calls="100" renewal-period="60" />
</outbound> - Place the header deletion configuration within the outbound section:
xml
<outbound>
<base />
<set-header name="X-Internal-Token" exists-action="delete" />
</outbound>
Cevap - DPlace the header deletion configuration within the inbound section:
xml
<inbound>
<base />
<set-header name="X-Internal-Token" exists-action="delete" />
</inbound>
Cevap
The correct configurations are placing the rate-limit policy in the inbound section to throttle incoming requests, and placing the set-header policy with exists-action set to delete in the outbound section to remove the response header returned by the backend.
The rate-limit policy must be placed in the inbound section to intercept and throttle client requests before they are forwarded. The set-header policy with exists-action set to delete must be placed in the outbound section to remove the specified header from the backend response before returning it to the client.
Adım Adım Çözüm
Anahtar Kavram
Azure API Management policies are executed sequentially across different sections (inbound, backend, outbound, on-error). Choosing the correct policy section is essential for routing, throttling, and modifying requests or responses.