CDN API Gateway & Rate Limiting 2 — Questions and Answers
Question 1: Which rate limiting algorithm uses a continuously refilling virtual container to smooth out traffic bursts?
- Sliding window counter
- Token bucket (Correct answer)
- Fixed window counter
- Leaky bucket
Correct answer: Token bucket
The token bucket algorithm refills tokens at a fixed rate and allows bursts up to the bucket capacity.
Question 2: An API gateway sitting in front of a CDN origin needs to enforce per-client quotas. Which HTTP header should the gateway return to tell clients when their quota resets?
- X-Rate-Limit-Retry-After
- Retry-After
- X-RateLimit-Reset (Correct answer)
- X-Quota-Expiry
Correct answer: X-RateLimit-Reset
X-RateLimit-Reset is the de facto standard header conveying the Unix timestamp when the rate limit window resets.
Question 3: A CDN's API gateway authenticates requests using JWT. Where should the gateway validate the JWT signature?
- At the origin server after forwarding
- At the CDN edge PoP before caching
- At the API gateway entry point before routing (Correct answer)
- In the client SDK before sending
Correct answer: At the API gateway entry point before routing
JWT validation at the API gateway entry point ensures unauthenticated requests are rejected before consuming backend resources.
Question 4: Which strategy allows an API gateway to enforce rate limits consistently across multiple geographically distributed edge nodes?
- Local in-memory counters per node
- Centralized distributed cache (e.g., Redis) (Correct answer)
- Client-side enforcement via SDK
- DNS TTL manipulation
Correct answer: Centralized distributed cache (e.g., Redis)
A centralized distributed cache like Redis lets all edge nodes share and atomically update the same rate limit counters.
Question 5: What HTTP status code should an API gateway return when a client exceeds its rate limit?
- 400 Bad Request
- 401 Unauthorized
- 429 Too Many Requests (Correct answer)
- 503 Service Unavailable
Correct answer: 429 Too Many Requests
RFC 6585 defines 429 Too Many Requests as the correct response when a client has exceeded the allowed rate.
Question 6: In an API gateway context, what is 'request throttling' as opposed to 'rate limiting'?
- Throttling blocks requests permanently; rate limiting is temporary
- Throttling slows down processing speed; rate limiting caps request count (Correct answer)
- Throttling applies to data size; rate limiting applies to request frequency
- They are identical concepts with different naming conventions
Correct answer: Throttling slows down processing speed; rate limiting caps request count
Throttling reduces the speed at which requests are processed, while rate limiting enforces a maximum number of requests in a time window.
Question 7: A CDN provider offers tiered API plans. Which rate limiting key granularity best supports per-plan enforcement?
- Source IP address
- API key or subscription tier identifier (Correct answer)
- User-Agent string
- Geographic region
Correct answer: API key or subscription tier identifier
Using the API key or subscription tier as the rate limit key allows distinct quotas to be applied per plan regardless of client IP.
CDN API Gateway & Rate Limiting 2
Which rate limiting algorithm uses a continuously refilling virtual container to smooth out traffic bursts?