A parking-citation API behind one OCI API Gateway deployment is overwhelmed by a noisy public client. Operators want a simple ceiling that protects every back end on that deployment. Per-partner paid tiers will come later. Which control matches that need?
Select an answer to reveal the explanation.
Short Explanation
Think of the deployment as one front door with a single turnstile—rate limiting on API Gateway spins for the whole door, not one hallway. Use a deployment-wide rate-limiting request policy to shield every back end from a noisy client. Per-customer ceilings belong on a usage plan’s entitlement rate and quota, which is a different object.
Full Explanation
When one noisy public client overwhelms every back end behind a single OCI API Gateway deployment, the matching simple control is a rate-limiting request policy on the deployment. In OCI API Gateway, rate-limiting request policies apply to the entire deployment; they are not attached to one route in isolation. That global ceiling protects all parking-citation back ends behind the front door with one policy—exactly what operators want before introducing per-partner paid tiers.
Attaching a separate rate-limiting request policy per route fails the product model: that policy type is deployment-scoped, not a per-route knob. Replacing authentication with a usage-plan token and treating the token as the only security control confuses metering with identity and removes authentication rather than adding a traffic ceiling. Lowering Functions memory so cold starts “throttle” a noisy client is unreliable capacity abuse, not a documented gateway rate limit, and harms legitimate callers.
Exam caveat: deployment-wide rate limiting and usage-plan entitlement rate/quota are different objects. Per-subscriber paid tiers belong on usage-plan entitlements later; do not assume the deployment rate-limit policy is per customer.
Operational check: apply a deployment rate-limiting policy with a known threshold, drive traffic above it from a test client, confirm 429-style rejection across routes, and ensure a second quieter client on the same deployment is still protected by the shared ceiling as designed.