CDN API Gateway & Rate Limiting 3 — Questions and Answers
Question 1: Which leaky bucket characteristic differentiates it from the token bucket algorithm?
- Leaky bucket permits bursts; token bucket enforces a constant rate
- Leaky bucket enforces a constant output rate; token bucket permits bursts up to capacity (Correct answer)
- Leaky bucket uses timestamps; token bucket uses counters
- Leaky bucket works at Layer 7; token bucket works at Layer 4
Correct answer: Leaky bucket enforces a constant output rate; token bucket permits bursts up to capacity
The leaky bucket processes requests at a fixed constant rate regardless of input bursts, while the token bucket allows short bursts up to the bucket size.
Question 2: An API gateway must route requests to different CDN origin clusters based on the API version in the URL path. What is this pattern called?
- Load balancing
- Content-based routing
- Path-based routing (Correct answer)
- Header-based routing
Correct answer: Path-based routing
Path-based routing directs traffic to different backends based on URL path segments, such as /v1/ or /v2/.
Question 3: What does the Retry-After response header communicate to an API client after a 429 response?
- The maximum allowed requests per minute
- How many seconds or a date until the client can retry (Correct answer)
- The remaining quota in the current window
- The new API key the client should use
Correct answer: How many seconds or a date until the client can retry
Retry-After tells the client either a delay in seconds or an HTTP-date after which it may safely retry the request.
Question 4: Which security threat does an API gateway's rate limiter most directly mitigate against CDN infrastructure?
- SQL injection attacks
- Credential stuffing and brute force attacks (Correct answer)
- Man-in-the-middle attacks
- DNS cache poisoning
Correct answer: Credential stuffing and brute force attacks
Rate limiting restricts the number of login or token attempts, directly throttling credential stuffing and brute force attacks.
Question 5: A CDN's API gateway implements mutual TLS (mTLS). What does the gateway verify in addition to the server certificate?
- The client's IP address geolocation
- The client's certificate during the TLS handshake (Correct answer)
- The client's JWT bearer token in the Authorization header
- The client's OAuth2 refresh token
Correct answer: The client's certificate during the TLS handshake
In mTLS, both parties present certificates; the gateway verifies the client certificate to ensure only authorized clients connect.
Question 6: What is the primary purpose of an API gateway's 'circuit breaker' pattern when integrated with a CDN?
- To encrypt all traffic between edge and origin
- To stop sending requests to a failing origin and return cached or error responses (Correct answer)
- To rewrite API responses into CDN-friendly formats
- To rate limit outbound CDN traffic
Correct answer: To stop sending requests to a failing origin and return cached or error responses
A circuit breaker detects repeated failures to an origin and temporarily stops forwarding requests, protecting the origin from further overload.
Question 7: Which HTTP method is typically exempt from CDN caching and therefore has the most direct impact on API gateway rate limiting?
- GET
- HEAD
- OPTIONS
- POST (Correct answer)
Correct answer: POST
POST requests are not cached by CDNs because they carry request bodies and mutate state, so every POST hits the origin and the rate limiter.
CDN API Gateway & Rate Limiting 3
Which leaky bucket characteristic differentiates it from the token bucket algorithm?