CDN API Gateway & Rate Limiting 4 — Questions and Answers
Question 1: An API gateway must handle 10,000 requests per second but the origin can only process 1,000 RPS. Which pattern should the gateway use to buffer the excess traffic?
- Synchronous request mirroring
- Request queuing with backpressure (Correct answer)
- Round-robin DNS
- Anycast routing
Correct answer: Request queuing with backpressure
Request queuing with backpressure buffers excess requests and signals upstream clients to slow down, protecting the origin from overload.
Question 2: Which OAuth 2.0 grant type is most appropriate for server-to-server CDN API authentication without a human user?
- Authorization Code
- Implicit
- Client Credentials (Correct answer)
- Resource Owner Password
Correct answer: Client Credentials
The Client Credentials grant allows a service to authenticate directly with the authorization server using its own credentials, with no user interaction required.
Question 3: A sliding window rate limiter differs from a fixed window rate limiter in that it:
- Uses a distributed cache instead of local memory
- Prevents burst exploitation at window boundaries (Correct answer)
- Only counts successful responses, not errors
- Applies limits per geographic region
Correct answer: Prevents burst exploitation at window boundaries
A sliding window calculates the request count over the last N seconds continuously, preventing clients from exploiting the reset moment of fixed windows.
Question 4: What is 'API versioning' and why is it important in a CDN API gateway deployment?
- Tracking the number of API calls per version for billing purposes
- Allowing backward-compatible evolution of the API without breaking existing clients (Correct answer)
- Encrypting API responses with version-specific keys
- Assigning different CDN PoPs to different API versions
Correct answer: Allowing backward-compatible evolution of the API without breaking existing clients
API versioning lets providers evolve the API contract while existing clients continue to use older versions without disruption.
Question 5: A CDN provider needs to expose a single API endpoint that aggregates data from five internal microservices. Which API gateway pattern accomplishes this?
- Pass-through proxy
- API composition / aggregation (Correct answer)
- Blue-green deployment
- Canary routing
Correct answer: API composition / aggregation
API composition aggregates responses from multiple backend microservices into a single client-facing response, reducing client round trips.
Question 6: Which CDN API gateway feature helps detect and block abnormally large API payloads that could exhaust origin resources?
- TLS certificate pinning
- Request size limiting and payload inspection (Correct answer)
- CORS policy enforcement
- Cache TTL configuration
Correct answer: Request size limiting and payload inspection
Request size limiting rejects or truncates payloads exceeding a configured threshold, preventing large-body DoS attacks on the origin.
Question 7: What does 'quota' differ from 'rate limit' in an API gateway context?
- Quota applies per request; rate limit applies per session
- Quota is a long-period allowance (daily/monthly); rate limit is a short-period cap (per second/minute) (Correct answer)
- Quota is enforced client-side; rate limit is enforced server-side
- Quota applies to data transfer; rate limit applies to CPU usage
Correct answer: Quota is a long-period allowance (daily/monthly); rate limit is a short-period cap (per second/minute)
A quota defines a total usage ceiling over a longer period like a day or month, while a rate limit restricts calls within a short window like per second.
CDN API Gateway & Rate Limiting 4
An API gateway must handle 10,000 requests per second but the origin can only process 1,000 RPS.
Which pattern should the gateway use to buffer the excess traffic?