Microservice API Gateways GCSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary benefit of an API gateway integrating with a service registry?

   • AIt reduces the number of API gateway instances required
   • BIt eliminates the need for authentication on API requests
   • CIt allows the gateway to route requests to healthy instances without hard-coding their addresses
   • DIt automatically encrypts all traffic between the gateway and services
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is reviewing the API gateway configuration for a financial services application. They notice that the gateway terminates TLS and forwards plaintext HTTP to backend services. They also see that the gateway logs full request and response bodies. What should the team recommend to improve security?

   • AEnable TLS between the gateway and backend services, and redact sensitive fields in logs.
   • BUse a network load balancer instead of the API gateway to handle TLS and remove logging entirely.
   • CKeep TLS termination at the gateway but disable logging of request bodies to reduce storage costs.
   • DMove TLS termination to each backend service and keep the gateway logging as is.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A team is deploying a new microservice instance in a container orchestration platform. They want the API gateway to automatically start sending traffic to the new instance without manual configuration. What should they rely on?

   • AA static DNS record that points to the new instance's IP.
   • BA manual update to the gateway's route table after each deployment.
   • CA client-side library that discovers the instance and calls it directly.
   • DService discovery registration, where the new instance registers itself and the gateway queries the registry.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A microservices application uses a service registry where each service instance registers its IP address and health status. The API gateway needs to route requests only to healthy instances. How should the gateway use the registry?

   • AQuery the registry periodically to get the list of healthy instances and update its routing table accordingly.
   • BConfigure the gateway to ignore the registry and use DNS round-robin for all instances.
   • CUse a static list of all registered instances, including unhealthy ones, and rely on retries.
   • DHave the registry push all traffic to the gateway, which then forwards it to any instance.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security operations team is analyzing API gateway logs to detect a potential credential stuffing attack. The logs show a high number of login attempts from many different IP addresses, but each IP has a low number of attempts. The team wants to detect this pattern without blocking legitimate users. Which detection strategy is most effective?

   • AAlert when any single IP exceeds a high number of login attempts.
   • BIncrease the rate limit for login endpoints to allow more attempts.
   • CAlert when the same username is attempted from multiple IP addresses within a short time window.
   • DBlock all traffic from IP addresses that have any failed login attempt.
   Reveal Solution Discussion Select an answer first