Microservices Microservice Security Patterns 2 — Questions and Answers
Question 1: In a microservices architecture, what is the primary purpose of the API Gateway as a security pattern?
- To store all user passwords in a central database
- To act as a single entry point that enforces authentication, rate limiting, and routing (Correct answer)
- To compile microservice source code at runtime
- To replace the need for individual service databases
Correct answer: To act as a single entry point that enforces authentication, rate limiting, and routing
The API Gateway centralizes cross-cutting security concerns like authentication and rate limiting at a single entry point.
Question 2: What does mutual TLS (mTLS) provide between two microservices?
- Bidirectional authentication where both client and server verify each other's certificates (Correct answer)
- Faster plaintext communication
- Automatic database replication
- Only server-side identity verification
Correct answer: Bidirectional authentication where both client and server verify each other's certificates
mTLS authenticates both parties using certificates, ensuring each service trusts the other.
Question 3: Which token format is most commonly used to propagate user identity between microservices in a stateless way?
- Plain session cookies stored on disk
- JSON Web Tokens (JWT) (Correct answer)
- Raw database connection strings
- Base64-encoded passwords
Correct answer: JSON Web Tokens (JWT)
JWTs carry signed claims, allowing stateless identity propagation across services.
Question 4: What is the main security risk of allowing direct service-to-service calls without authentication inside a cluster?
- Increased disk usage
- Lateral movement, where a compromised service can freely call other services (Correct answer)
- Slower DNS resolution
- Larger container images
Correct answer: Lateral movement, where a compromised service can freely call other services
Without internal authentication, an attacker who breaches one service can pivot to others unchecked.
Question 5: In the context of microservice security, what does the principle of 'defense in depth' recommend?
- Relying solely on the firewall at the network edge
- Layering multiple independent security controls so no single failure is catastrophic (Correct answer)
- Encrypting only the database and nothing else
- Disabling all logging to reduce attack surface
Correct answer: Layering multiple independent security controls so no single failure is catastrophic
Defense in depth uses multiple overlapping controls so one bypassed layer does not compromise the whole system.
Question 6: Which pattern delegates authentication to a dedicated identity provider that issues tokens to clients?
- OAuth 2.0 / OpenID Connect (Correct answer)
- Round-robin load balancing
- Circuit breaker
- Database sharding
Correct answer: OAuth 2.0 / OpenID Connect
OAuth 2.0 with OpenID Connect uses a central authorization server to issue access and identity tokens.
Question 7: Why is storing secrets like API keys directly in container images considered an anti-pattern?
- Images load faster without secrets
- Anyone with image access can extract the secrets, and they cannot be rotated easily (Correct answer)
- Secrets corrupt the image layers
- It violates JSON formatting rules
Correct answer: Anyone with image access can extract the secrets, and they cannot be rotated easily
Baked-in secrets are exposed to anyone with image access and are hard to rotate, so a secrets manager is preferred.
Microservices Microservice Security Patterns 2
In a microservices architecture, what is the primary purpose of the API Gateway as a security pattern?