A security architect is comparing two application-layer components. Which statement correctly distinguishes a web application firewall (WAF) from an API gateway in a cloud application architecture?
- AA WAF terminates TLS and issues client certificates, whereas an API gateway inspects payloads for SQL injection and cross-site scripting signatures.
- BA WAF inspects and filters HTTP traffic against attack patterns such as injection and cross-site scripting, whereas an API gateway primarily manages, routes, authenticates and rate-limits calls to backend services. Correct
- CA WAF and an API gateway are interchangeable names for the same reverse-proxy component, differing only by cloud vendor branding.
- DA WAF encrypts data at rest in the application database, whereas an API gateway encrypts data in transit between microservices.
Why A is wrong: This inverts the roles by giving the API gateway the WAF's signature-inspection job, and issuing client certificates is a certificate authority function rather than a WAF one.
Why B is correct: This captures the core distinction: a WAF is a protective filter for web traffic, while an API gateway is a management and routing layer that fronts APIs, even though both sit in front of applications.
Why C is wrong: It is tempting because both are reverse-proxy style components at the edge, but they serve distinct purposes and are commonly deployed together, not as synonyms.
Why D is wrong: Neither component is a data-at-rest encryption control, so this misattributes storage encryption to a WAF and overstates the gateway's role.