A security team is reviewing the API gateway configuration for a microservices platform. They want to ensure that backend services are not directly reachable from the internet and that all client requests are authenticated before reaching the services. Which two configurations should be implemented together?

Configure the gateway to validate API keys and forward them to backend services for authorization.

Use a web application firewall (WAF) in front of the gateway and allow direct access to backend services from the internet.

Enable TLS termination at the gateway and forward plain HTTP to backend services.

Place the gateway in a public subnet and backend services in a private subnet with no public IP addresses.

A large enterprise is adopting microservices. They have a mix of legacy services that need to be exposed externally and new services that are only used internally. The security team mandates that all external traffic must pass through a single, audited entry point. The development teams want to deploy new services independently without waiting for central gateway changes. Which pattern best satisfies both constraints?

Use a sidecar gateway for every service instance, with all traffic routed through the sidecars.

Deploy a per-service gateway for each new service, and keep the legacy services behind a central gateway.

Use a centralized gateway for all external traffic, and allow internal services to communicate directly via service discovery.

Expose all services directly through a load balancer without an API gateway.

A compliance requirement states that all API gateway access logs must be retained for at least one year and must be tamper-evident. Which logging configuration should the team implement?

Enable verbose logging and keep the logs in memory for the lifetime of the gateway.

Stream logs to an immutable, write-once storage service with retention policies set to one year.

Send logs to a standard database and allow administrators to delete old records.

Store logs on the gateway's local disk and rotate them every 30 days.

GIAC Cloud Security Automation

Domain 4Objective 3

Microservice API Gateways GCSA Practice Questions (Page 1)

Part of the Container and Microservices Lifecycle domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 1–5

1application · medium
A security team is reviewing the API gateway configuration for a microservices platform. They want to ensure that backend services are not directly reachable from the internet and that all client requests are authenticated before reaching the services. Which two configurations should be implemented together?
Select an answer first
2expert · hard
A large enterprise is adopting microservices. They have a mix of legacy services that need to be exposed externally and new services that are only used internally. The security team mandates that all external traffic must pass through a single, audited entry point. The development teams want to deploy new services independently without waiting for central gateway changes. Which pattern best satisfies both constraints?
Select an answer first
3application · medium
A compliance requirement states that all API gateway access logs must be retained for at least one year and must be tamper-evident. Which logging configuration should the team implement?
Select an answer first
4foundation · easy
Which API gateway security function verifies the identity of a client by inspecting a JSON Web Token (JWT) presented with a request?
Select an answer first
5foundation · easy
Which API gateway deployment pattern places a dedicated gateway instance in front of each microservice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Microservice API Gateways GCSA Practice Questions (Page 1)

Questions 1–5

A compliance requirement states that all API gateway access logs must be retained for at least one year and must be tamper-evident. Which logging configuration should the team implement?

Which API gateway security function verifies the identity of a client by inspecting a JSON Web Token (JWT) presented with a request?

Which API gateway deployment pattern places a dedicated gateway instance in front of each microservice?

Keep studying — Container and Microservices Lifecycle