CDN API Gateway & Rate Limiting 5 — Questions and Answers
Question 1: When a CDN API gateway returns an ETag header with an API response, what rate limiting benefit does client-side caching provide?
- It increases the request rate by batching multiple calls
- It reduces redundant API calls by allowing conditional GET requests, preserving quota (Correct answer)
- It bypasses rate limiting for authenticated users
- It automatically retries failed requests within the rate limit window
Correct answer: It reduces redundant API calls by allowing conditional GET requests, preserving quota
Clients using ETags with If-None-Match can receive 304 Not Modified responses, avoiding full API calls and conserving their rate limit quota.
Question 2: Which API gateway strategy helps prevent a 'noisy neighbor' tenant from degrading CDN API performance for other tenants?
- Shared rate limit pool across all tenants
- Per-tenant rate limit isolation with dedicated counters (Correct answer)
- Global IP-based rate limiting only
- Single-tenant rate limiting applied to the largest customer
Correct answer: Per-tenant rate limit isolation with dedicated counters
Per-tenant isolation ensures one high-traffic tenant's rate limit counters do not affect other tenants' quotas or performance.
Question 3: An API gateway uses GraphQL instead of REST. Which rate limiting dimension is most important to add beyond simple request count?
- Response payload compression ratio
- Query complexity or depth scoring (Correct answer)
- Client geographic location
- TLS cipher suite selection
Correct answer: Query complexity or depth scoring
GraphQL queries can vary enormously in compute cost, so complexity or depth scoring prevents cheap request counts from hiding expensive query execution.
Question 4: What is the role of a 'developer portal' in a CDN's API gateway ecosystem?
- To serve as a CDN origin server for static assets
- To provide documentation, API key management, and quota dashboards to API consumers (Correct answer)
- To run rate limit enforcement rules at the edge
- To replicate API gateway configuration across all PoPs
Correct answer: To provide documentation, API key management, and quota dashboards to API consumers
A developer portal gives external consumers self-service access to API documentation, key generation, and usage/quota monitoring.
Question 5: A CDN API gateway needs to enforce rate limits even during a Redis cluster failover. Which approach maintains availability?
- Stop accepting API requests during failover
- Fall back to local in-memory approximate rate limiting per node (Correct answer)
- Switch to client-side rate limiting via SDK
- Return 503 for all requests until Redis recovers
Correct answer: Fall back to local in-memory approximate rate limiting per node
Falling back to local in-memory counters provides approximate rate limiting continuity during a distributed cache outage instead of fully blocking traffic.
Question 6: Which CDN API gateway feature allows operators to test a new rate limiting policy on 5% of traffic before full rollout?
- Blue-green switching
- Canary deployment / traffic splitting (Correct answer)
- A/B header injection
- Shadow mode logging
Correct answer: Canary deployment / traffic splitting
Canary deployment routes a small percentage of traffic through the new policy, allowing validation before exposing all traffic to the change.
Question 7: When configuring CORS on a CDN API gateway, which header must be present in the preflight OPTIONS response to allow cross-origin API calls from a browser?
- Access-Control-Allow-Origin (Correct answer)
- Content-Security-Policy
- X-Frame-Options
- Strict-Transport-Security
Correct answer: Access-Control-Allow-Origin
Access-Control-Allow-Origin specifies which origins are permitted to make cross-origin requests; without it browsers block the API call.
CDN API Gateway & Rate Limiting 5
When a CDN API gateway returns an ETag header with an API response, what rate limiting benefit does client-side caching provide?