Api Gateway hard
Enabling Mutual TLS (mTLS) for all internal traffic (Gateway -> Service) increases CPU utilization and increases latency. What part of the TLS lifecycle is the primary bottleneck at high scale?
- A The symmetric encryption of the data packets (AES-GCM), which requires massive algorithmic work for every byte sent.
- B The memory overhead of holding the TCP socket open for the duration of the transfer.
- C The asymmetric cryptographic handshake, specifically the cost of RSA/ECC private key operations to prove identity for every new connection.
- D The time spent by the OS kernel verifying the file system permissions of the certificate files.
Answer: C. The asymmetric cryptographic handshake, specifically the cost of RSA/ECC private key operations to prove identity for every new connection.
Asymmetric crypto is orders of magnitude slower than symmetric crypto. In a high-churn environment where many new connections are created per second, the 'Handshake' is the killer. Solutions include TLS Session Resumption, Keep-Alive, or hardware offloading via AES-NI/QuickAssist.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?