A security auditor requires evidence of all API calls to a microservices platform, including the client IP, requested route, response status, and latency. The team must ensure this data is available for incident investigation. What should the team configure on the API gateway?

Enable error logging only, capturing exceptions thrown by backend services.

Use the gateway's metrics dashboard to view live traffic, without retaining historical logs.

Configure the gateway to store request payloads in memory for 24 hours.

Enable detailed access logging that captures request metadata, response status, and timing, and ship logs to a centralized SIEM.

A team is rolling out a new version of the 'payments' microservice. They want to test the new version with a small percentage of real traffic while keeping the old version available for the majority of users. Which API gateway configuration should they use?

Update the route to point all traffic to the new version immediately.

Use the gateway's rate limiting feature to limit requests to the new version.

Create a new route for the new version and require clients to change their URLs.

Configure a weighted routing rule that sends 10% of traffic to the new version and 90% to the old version.

A team runs microservices in a dynamic environment where instances are frequently scaled up and down. The API gateway is configured with a static list of backend IPs. Recently, requests have failed because instances were decommissioned. What is the most effective long-term solution?

Use a load balancer in front of the gateway to hide the failures.

Increase the timeout on the gateway so it retries failed requests longer.

Add more static IPs to the gateway configuration to cover future instances.

Integrate the gateway with the service discovery system so it dynamically updates backend targets.

In an API gateway, what is a 'route' typically used for?

To define how incoming requests are matched and forwarded to a specific backend service

To define the load balancing algorithm for the gateway

To store the API keys of all authenticated clients

To specify the database connection string for the gateway

During a rolling update of a microservice, how does an API gateway contribute to a seamless deployment?

It compiles the new version of the microservice before routing traffic

It automatically rolls back the update if any error occurs

It stops all traffic to the microservice until the update is complete

It routes traffic only to healthy instances, gradually shifting traffic as new instances become ready

GIAC Cloud Security Automation

Domain 4Objective 3

Microservice API Gateways GCSA Practice Questions (Page 4)

Part of the Container and Microservices Lifecycle domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 16–20

16application · medium
A security auditor requires evidence of all API calls to a microservices platform, including the client IP, requested route, response status, and latency. The team must ensure this data is available for incident investigation. What should the team configure on the API gateway?
Select an answer first
17application · medium
A team is rolling out a new version of the 'payments' microservice. They want to test the new version with a small percentage of real traffic while keeping the old version available for the majority of users. Which API gateway configuration should they use?
Select an answer first
18expert · hard
A team runs microservices in a dynamic environment where instances are frequently scaled up and down. The API gateway is configured with a static list of backend IPs. Recently, requests have failed because instances were decommissioned. What is the most effective long-term solution?
Select an answer first
19foundation · easy
In an API gateway, what is a 'route' typically used for?
Select an answer first
20foundation · easy
During a rolling update of a microservice, how does an API gateway contribute to a seamless deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.