Microservices Microservice Security Patterns 3 — Questions and Answers
Question 1: What is the role of a service mesh (e.g., Istio, Linkerd) in microservice security?
- It writes application business logic automatically
- It transparently handles mTLS, authorization policies, and observability via sidecar proxies (Correct answer)
- It replaces the need for any container orchestrator
- It compiles services into a single monolith
Correct answer: It transparently handles mTLS, authorization policies, and observability via sidecar proxies
A service mesh uses sidecar proxies to enforce encryption and policy without changing application code.
Question 2: In token-based security, what is a 'token relay' or 'token propagation' pattern?
- Forwarding the user's access token from one service to downstream services to preserve identity (Correct answer)
- Encrypting the token with a different algorithm each hop
- Storing tokens in browser localStorage permanently
- Converting tokens into cookies for storage
Correct answer: Forwarding the user's access token from one service to downstream services to preserve identity
Token relay passes the original access token downstream so each service can authorize using the same user context.
Question 3: What security advantage does short-lived token expiry provide?
- It eliminates the need for HTTPS
- It limits the window of misuse if a token is leaked or stolen (Correct answer)
- It makes tokens larger and harder to read
- It removes the need for any authentication server
Correct answer: It limits the window of misuse if a token is leaked or stolen
Short expiry reduces how long a stolen token remains valid, minimizing damage.
Question 4: Which approach best prevents an attacker from forging a JWT?
- Using a strong signing key and validating the signature on every service (Correct answer)
- Base64-encoding the payload twice
- Sending the JWT only over UDP
- Storing the JWT in plaintext logs
Correct answer: Using a strong signing key and validating the signature on every service
Validating the cryptographic signature with a protected key ensures tokens cannot be forged.
Question 5: What is the purpose of the 'aud' (audience) claim in a JWT used across microservices?
- To set the token's font size
- To specify which service(s) the token is intended for, so others reject it (Correct answer)
- To compress the token
- To store the user's password
Correct answer: To specify which service(s) the token is intended for, so others reject it
The audience claim restricts which services should accept the token, preventing misuse elsewhere.
Question 6: Why should microservices avoid trusting the network perimeter alone (the 'zero trust' principle)?
- Because internal networks can be breached, so every request must still be authenticated and authorized (Correct answer)
- Because perimeters make services run slower
- Because firewalls are illegal in cloud environments
- Because zero trust removes the need for encryption
Correct answer: Because internal networks can be breached, so every request must still be authenticated and authorized
Zero trust assumes the internal network may be compromised, so each request is verified regardless of origin.
Question 7: What is a common pattern for handling authorization decisions consistently across many microservices?
- Hardcoding rules in each service separately
- Using a centralized policy engine like Open Policy Agent (OPA) (Correct answer)
- Letting the database decide all access
- Disabling authorization for internal traffic
Correct answer: Using a centralized policy engine like Open Policy Agent (OPA)
A centralized policy engine like OPA externalizes and unifies authorization decisions across services.
Microservices Microservice Security Patterns 3
What is the role of a service mesh (e.g., Istio, Linkerd) in microservice security?