Microservices Microservice Security Patterns 2

Question 1

In a microservices architecture, what is the primary purpose of the API Gateway as a security pattern?

Accepted Answer

To act as a single entry point that enforces authentication, rate limiting, and routing

Answer

To store all user passwords in a central database

Answer

To compile microservice source code at runtime

Answer

To replace the need for individual service databases

Question 2

What does mutual TLS (mTLS) provide between two microservices?

Accepted Answer

Bidirectional authentication where both client and server verify each other's certificates

Answer

Faster plaintext communication

Answer

Automatic database replication

Answer

Only server-side identity verification

Question 3

Which token format is most commonly used to propagate user identity between microservices in a stateless way?

Accepted Answer

JSON Web Tokens (JWT)

Answer

Plain session cookies stored on disk

Answer

Raw database connection strings

Answer

Base64-encoded passwords

Question 4

What is the main security risk of allowing direct service-to-service calls without authentication inside a cluster?

Accepted Answer

Lateral movement, where a compromised service can freely call other services

Answer

Increased disk usage

Answer

Slower DNS resolution

Answer

Larger container images

Question 5

In the context of microservice security, what does the principle of 'defense in depth' recommend?

Accepted Answer

Layering multiple independent security controls so no single failure is catastrophic

Answer

Relying solely on the firewall at the network edge

Answer

Encrypting only the database and nothing else

Answer

Disabling all logging to reduce attack surface

Question 6

Which pattern delegates authentication to a dedicated identity provider that issues tokens to clients?

Accepted Answer

OAuth 2.0 / OpenID Connect

Answer

Round-robin load balancing

Answer

Circuit breaker

Answer

Database sharding

Question 7

Why is storing secrets like API keys directly in container images considered an anti-pattern?

Accepted Answer

Anyone with image access can extract the secrets, and they cannot be rotated easily

Answer

Images load faster without secrets

Answer

Secrets corrupt the image layers

Answer

It violates JSON formatting rules