A county GraphQL endpoint applies a per-HTTP-request rate limit, yet a single request can batch many aliased operations. What control gap should the tester highlight?
Select an answer to reveal the explanation.
Short Explanation
Counting cars while ignoring buses packed with riders undercounts traffic. A GraphQL batch can hide many operations inside one HTTP request, so request-only rate limits miss the abuse. Turning off introspection is not a quota system.
Full Explanation
GraphQL batching and aliases can multiply work per HTTP request, bypassing naive per-request rate limits. Testers should flag limits that ignore operation cost or count. Batching does not imply solid authorization, and disabling introspection alone does not enforce quotas. Recommend operation-aware throttling, complexity limits, and authz checks per field or mutation.