Microservices Microservice Security Patterns 2

Question 1

In a microservices architecture, what is the primary purpose of the API Gateway as a security pattern?

Accepted Answer

To act as a single entry point that enforces authentication, rate limiting, and routing

Answer

The API Gateway centralizes cross-cutting security concerns like authentication and rate limiting at a single entry point.

Question 2

What does mutual TLS (mTLS) provide between two microservices?

Accepted Answer

Bidirectional authentication where both client and server verify each other's certificates

Answer

mTLS authenticates both parties using certificates, ensuring each service trusts the other.

Question 3

Which token format is most commonly used to propagate user identity between microservices in a stateless way?

Accepted Answer

JSON Web Tokens (JWT)

Answer

JWTs carry signed claims, allowing stateless identity propagation across services.

Question 4

What is the main security risk of allowing direct service-to-service calls without authentication inside a cluster?

Accepted Answer

Lateral movement, where a compromised service can freely call other services

Answer

Without internal authentication, an attacker who breaches one service can pivot to others unchecked.

Question 5

In the context of microservice security, what does the principle of 'defense in depth' recommend?

Accepted Answer

Layering multiple independent security controls so no single failure is catastrophic

Answer

Defense in depth uses multiple overlapping controls so one bypassed layer does not compromise the whole system.

Microservices Practice Test