SAP-C02 Practice Question 64: API Tiers Usage Plans Authorization

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 7 · question 4 of 10

Design for New Solutionsmedium

A software vendor publishes a REST API through Amazon API Gateway to about 200 customers. A free tier must be limited to 1,000 requests per day and 5 requests per second per customer, and a paid tier gets higher limits. Customers already sign in through an Amazon Cognito user pool. The vendor wants each customer's traffic limited individually, so that one heavy customer cannot use up the capacity that other customers rely on, and wants to keep authorizing access properly.

Which design should the solutions architect choose?

Show answer and explanation

Answer:

B. Create usage plans with throttling and quota limits per tier, issue each customer an API key, and keep the Cognito authorizer

API Gateway usage plans let you *"make [APIs] available as product offerings for your customers"* and throttle requests based on defined limits: a *throttling limit* sets the point at which throttling starts, and a *quota limit* sets the maximum requests per key in a time interval. The plan uses API keys to identify each client, so each customer is limited individually. AWS is explicit that *"you can use API keys together with Lambda authorizers, IAM roles, or Amazon Cognito to control access"* and that you should not use API keys for authentication or authorization (option B). The plans are applied on a best-effort basis, so AWS suggests AWS Budgets and AWS WAF as additional controls.

- A is wrong because AWS states: *"Don't use API keys for authentication or authorization to control access to your APIs."* A key identifies a client for throttling. It is not a credential. - C is wrong because a WAF rate-based rule counts requests per source, typically an IP address, over a short window. It does not implement per-customer daily quotas by tier. - D is wrong because reserved concurrency limits the whole function, not each customer, and one alias per customer does not enforce request-rate or quota limits.

Reference: Usage plans and API keys for REST APIs in API Gateway

Practice Test 7 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.

SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.

AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.

IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.

SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.

VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.