Microservice API Gateways GCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A startup is building a microservices platform with a small team. They want to enforce consistent security policies (authentication, rate limiting) across all services, but they also want to avoid a single point of failure. Which gateway deployment pattern best balances these concerns?

   • ARely on the application load balancer to enforce authentication and rate limiting, without a dedicated API gateway.
   • BDeploy a separate gateway instance for each microservice, each with its own policy configuration.
   • CDeploy a centralized gateway as a cluster of multiple instances behind a load balancer.
   • DUse a sidecar gateway for every service instance, but configure each sidecar independently.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A platform team is designing API access for a large microservices environment. They have two requirements: (1) a single, consistent authentication and rate-limiting policy for all external clients, and (2) the ability for individual service teams to add service-specific request validation without waiting for a central team. Which deployment pattern best satisfies both requirements?

   • ACentralized gateway for external traffic, with per-service lightweight gateways or sidecars for internal service-specific policies.
   • BOnly a centralized gateway that handles all policies for every service.
   • COnly per-service gateways, each with its own authentication and rate limiting.
   • DSidecar proxies on every service, with no centralized gateway.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team is managing an API gateway with multiple versions of the same API. They want to allow clients to continue using version 1 while gradually migrating to version 2. They also need to apply different rate limits to each version. What should they do?

   • ARedirect all traffic from /v1/ to /v2/ immediately and remove the v1 route.
   • BDefine separate routes for /v1/ and /v2/ with distinct rate-limit policies for each route.
   • CDisable versioning and expose only the latest version of the API.
   • DUse a single route for both versions and apply the same rate limit to all requests.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's API gateway currently forwards requests to backend services without modification. They need to add a common header to all requests for internal tracking and also strip sensitive response headers before sending responses to clients. What should they configure on the gateway?

   • AModify each backend service to add the header and remove the sensitive headers.
   • BConfigure the gateway to cache responses and manually edit the cached headers.
   • CUse the gateway's rate-limiting policy to add the header and rely on the backend to remove sensitive headers.
   • DDefine a request transformation policy to add the header, and a response transformation policy to remove the sensitive headers.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is configuring an API gateway to protect against common web attacks. They want to inspect incoming requests for malicious payloads and block them before they reach microservices. Which gateway capability should they enable?

   • AWeb application firewall (WAF) rules integrated with the gateway.
   • BResponse transformation to sanitize output.
   • CRate limiting per client IP.
   • DTLS termination at the gateway.
   Reveal Solution Discussion Select an answer first