Microservice API Gateways GCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which monitoring metric is most useful for detecting a sudden spike in API traffic that could indicate a denial-of-service attack?

   • AAverage response time
   • BCPU utilization of the gateway
   • CNumber of active service instances
   • DRequests per second
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a microservices architecture, what is the primary purpose of an API gateway?

   • ATo compile and deploy microservice code to the production environment
   • BTo act as a single entry point that routes client requests to the appropriate microservices
   • CTo replace the need for service-to-service communication between microservices
   • DTo store and manage the database schemas used by all microservices
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations team wants to detect anomalous API traffic patterns, such as a sudden increase in 401 responses or requests to unusual endpoints. They have access to the API gateway logs. What should they implement to identify these patterns?

   • AStream gateway logs to a SIEM and create alerts for thresholds like error rates and unusual endpoint access.
   • BStore logs in a local file on the gateway and review them manually at the end of each month.
   • CEnable verbose logging for all requests and disable log rotation to keep all data.
   • DUse the gateway's built-in metrics dashboard to view current traffic, without historical analysis.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A team operates a microservices application where the mobile client expects a specific JSON response format, but the backend 'orders' service returns a different schema. The team wants to avoid changing the backend service and instead adapt the response at the edge. Which API gateway function should be used?

   • ATLS termination
   • BRate limiting
   • CResponse transformation
   • DRequest routing
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An API gateway is configured to validate JWT tokens by checking the signature and expiration. However, a penetration test reveals that a revoked user can still access APIs because the gateway does not check token revocation status. The team wants to block revoked tokens without adding significant latency to every request. Which approach should they take?

   • ADisable token validation at the gateway and rely on backend services to check revocation.
   • BUse a short token lifetime and rely on the token expiring soon after revocation.
   • CConfigure the gateway to call the authorization server's introspection endpoint for every request.
   • DMaintain a local cache of revoked token identifiers and check it before allowing access.
   Reveal Solution Discussion Select an answer first