API Gateway & Rate Limiting Flashcards

An API gateway must handle 10,000 requests per second but the origin can only process 1,000 RPS. Which pattern should the gateway use to buffer the excess traffic?

Answer: Request queuing with backpressure

Request queuing with backpressure buffers excess requests and signals upstream clients to slow down, protecting the origin from overload.

Which OAuth 2.0 grant type is most appropriate for server-to-server CDN API authentication without a human user?

Answer: Client Credentials

The Client Credentials grant allows a service to authenticate directly with the authorization server using its own credentials, with no user interaction required.

A sliding window rate limiter differs from a fixed window rate limiter in that it:

Answer: Prevents burst exploitation at window boundaries

A sliding window calculates the request count over the last N seconds continuously, preventing clients from exploiting the reset moment of fixed windows.

What is 'API versioning' and why is it important in a CDN API gateway deployment?

Answer: Allowing backward-compatible evolution of the API without breaking existing clients

API versioning lets providers evolve the API contract while existing clients continue to use older versions without disruption.

A CDN provider needs to expose a single API endpoint that aggregates data from five internal microservices. Which API gateway pattern accomplishes this?

Answer: API composition / aggregation

API composition aggregates responses from multiple backend microservices into a single client-facing response, reducing client round trips.

Which CDN API gateway feature helps detect and block abnormally large API payloads that could exhaust origin resources?

Answer: Request size limiting and payload inspection

Request size limiting rejects or truncates payloads exceeding a configured threshold, preventing large-body DoS attacks on the origin.

What does 'quota' differ from 'rate limit' in an API gateway context?

Answer: Quota is a long-period allowance (daily/monthly); rate limit is a short-period cap (per second/minute)

A quota defines a total usage ceiling over a longer period like a day or month, while a rate limit restricts calls within a short window like per second.