Microservice API Gateways GCSA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   An API gateway is experiencing a DDoS attack that overwhelms the backend services. The team wants to protect the backends while minimizing impact to legitimate users. They have the ability to configure rate limiting, IP blocking, and caching. Which combination of actions is most effective?

   • ABlock all traffic from IP addresses that are not in a pre-approved allowlist.
   • BEnable rate limiting per client, block known malicious IP ranges, and cache responses for static endpoints.
   • CEnable full request logging and analyze logs after the attack to identify attackers.
   • DDisable rate limiting to allow all traffic through, but increase backend capacity.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Why is logging API gateway traffic important for security auditing?

   • AIt automatically blocks all malicious requests
   • BIt eliminates the need for authentication
   • CIt provides a record of requests and responses that can be analyzed for suspicious activity
   • DIt reduces the latency of API calls
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company is refactoring a monolithic e-commerce application into microservices. The front-end web and mobile clients currently call the monolith directly. The team wants to introduce a single entry point for all client traffic, offload authentication, and enforce per-client request limits. Which approach should the team adopt?

   • ADeploy an API gateway that routes requests to backend services, validates JWT tokens, and applies rate limiting per client.
   • BHave each microservice implement its own authentication and rate limiting, and let clients call each service directly.
   • CUse a service mesh sidecar on each microservice to handle authentication and rate limiting, with no central gateway.
   • DConfigure the load balancer to route traffic directly to microservices and rely on the cloud provider's WAF for authentication.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security analyst is investigating a spike in traffic to the API gateway. The logs show many requests with unusual query parameters and a high rate of 500 errors. The analyst suspects a SQL injection attempt. What should the gateway be configured to do to mitigate this?

   • AIncrease the rate limit for all clients to allow more requests through.
   • BRoute all traffic to a single backend service for manual inspection.
   • CEnable a Web Application Firewall (WAF) policy on the gateway to inspect and block malicious query parameters.
   • DDisable logging of query parameters to hide the attack from logs.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A team is managing an API gateway that routes to multiple backend services. They need to introduce a new version of one service that requires a different authentication scope than the old version. The gateway currently applies a single authentication policy to all routes. What should they do to support both versions with different auth requirements?

   • AUse the same route for both versions and add the new scope to all tokens.
   • BChange the global authentication policy to require the new scope for all routes.
   • CCreate a separate route for the new version and attach a new authentication policy that requires the additional scope.
   • DDisable authentication for the new version and rely on the backend to enforce it.
   Reveal Solution Discussion Select an answer first