A security architect is comparing two application-layer components. Which statement correctly distinguishes a web application firewall (WAF) from an API gateway in a cloud application architecture?
AA WAF terminates TLS and issues client certificates, whereas an API gateway inspects payloads for SQL injection and cross-site scripting signatures.
BA WAF inspects and filters HTTP traffic against attack patterns such as injection and cross-site scripting, whereas an API gateway primarily manages, routes, authenticates and rate-limits calls to backend services.check_circle Correct
CA WAF and an API gateway are interchangeable names for the same reverse-proxy component, differing only by cloud vendor branding.
DA WAF encrypts data at rest in the application database, whereas an API gateway encrypts data in transit between microservices.
Distinguish a WAF as an HTTP attack filter from an API gateway as an API management and routing layer. A WAF applies rule sets and signatures to HTTP requests to block application-layer attacks like injection and cross-site scripting, while an API gateway centralises concerns such as routing, authentication, throttling and versioning for API traffic; they are complementary controls at different jobs.
Why A is wrong: This inverts the roles by giving the API gateway the WAF's signature-inspection job, and issuing client certificates is a certificate authority function rather than a WAF one.
Why B is correct: This captures the core distinction: a WAF is a protective filter for web traffic, while an API gateway is a management and routing layer that fronts APIs, even though both sit in front of applications.
Why C is wrong: It is tempting because both are reverse-proxy style components at the edge, but they serve distinct purposes and are commonly deployed together, not as synonyms.
Why D is wrong: Neither component is a data-at-rest encryption control, so this misattributes storage encryption to a WAF and overstates the gateway's role.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
Configure a network layer stateful firewall to restrict inbound traffic to the application's TCP ports.
errorWhy it is wrong: A network firewall filters by address and port at layers 3 and 4, so it cannot see or block malicious payloads inside otherwise valid HTTP requests on an open web port.
Enabling verbose stack-trace responses so callers can self-diagnose failed requests
errorWhy it is wrong: Detailed error output helps debugging but leaks internal detail to attackers and does nothing to authenticate callers or cap request volume, so it works against security.
A web application firewall placed in front of the application's public endpoint.
errorWhy it is wrong: A WAF inspects HTTP traffic at the application edge and would miss database-level activity such as direct queries from a compromised service account.