CCSP - Cloud Application Security - Section 4.6

Comprehend and apply the specifics of cloud application architecture.

Supplemental security components such as WAF and API gateway, cryptography, sandboxing, application virtualisation and orchestration.

web application firewall (WAF)API gatewaysandboxingapplication virtualisationdatabase activity monitoring

Practice question for this objective

Free sampleCloud Application Securitymedium

A security architect is comparing two application-layer components. Which statement correctly distinguishes a web application firewall (WAF) from an API gateway in a cloud application architecture?

  • AA WAF terminates TLS and issues client certificates, whereas an API gateway inspects payloads for SQL injection and cross-site scripting signatures.
  • BA WAF inspects and filters HTTP traffic against attack patterns such as injection and cross-site scripting, whereas an API gateway primarily manages, routes, authenticates and rate-limits calls to backend services. Correct
  • CA WAF and an API gateway are interchangeable names for the same reverse-proxy component, differing only by cloud vendor branding.
  • DA WAF encrypts data at rest in the application database, whereas an API gateway encrypts data in transit between microservices.
Distinguish a WAF as an HTTP attack filter from an API gateway as an API management and routing layer. A WAF applies rule sets and signatures to HTTP requests to block application-layer attacks like injection and cross-site scripting, while an API gateway centralises concerns such as routing, authentication, throttling and versioning for API traffic; they are complementary controls at different jobs.

Why A is wrong: This inverts the roles by giving the API gateway the WAF's signature-inspection job, and issuing client certificates is a certificate authority function rather than a WAF one.

Why B is correct: This captures the core distinction: a WAF is a protective filter for web traffic, while an API gateway is a management and routing layer that fronts APIs, even though both sit in front of applications.

Why C is wrong: It is tempting because both are reverse-proxy style components at the edge, but they serve distinct purposes and are commonly deployed together, not as synonyms.

Why D is wrong: Neither component is a data-at-rest encryption control, so this misattributes storage encryption to a WAF and overstates the gateway's role.

See more CCSP practice questions, answers explained.

More in this domain

Back to all Cloud Application Security objectives, or the CCSP cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.