CAS-004 Security Architecture Practice Question
A security architect is designing an API security strategy for a microservices-based application. The architect needs to ensure that only authenticated and authorized clients can invoke APIs, and that rate limiting is enforced to prevent abuse. Which technology should be placed in front of the microservices?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
API Gateway
An API gateway handles authentication, authorization, rate limiting, and routing, providing a central security control point.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
API Gateway
Why this is correct
API gateway can enforce authentication, authorization, rate limiting, and input validation.
- ✗
Web Application Firewall (WAF)
Why it's wrong here
WAF protects against web application attacks but does not provide API authentication or rate limiting.
- ✗
Reverse proxy
Why it's wrong here
A reverse proxy can load balance but typically lacks API-specific security features.
- ✗
Load balancer
Why it's wrong here
Load balancers distribute traffic but do not provide API security controls.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.