A public API needs per-client rate limits — free-tier callers capped at 10 req/s, paid callers at 1,000 req/s — enforced with API keys. Which API Gateway feature implements this?
A.WAF rate-based rules
WAF rates apply per-IP — can't tier by API key.
B.Usage plans with API keys, throttling limits, and quota per key
Correct. Per-key rate/burst/quota tiers.
C.Lambda authorizers counting requests
Authorizers return allow/deny — they don't meter usage.
D.CloudWatch alarms blocking clients
Alarms notify; they don't throttle.
Why this answer
Usage plans are the designed mechanism: attach API keys, set rate + burst + quota per plan, associate plans with keys and stages. WAF rate rules are IP-based (no per-key tiers), and authorizers gate access, not quotas.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Serverless & APIs practice session.
Practice Serverless & APIs