ISC2 Certified Cloud Security Professional (CCSP) Practice Question

An API gateway is designed to sit in front of a collection of services and act as a single ingress point. It can enforce authentication and authorization, apply rate-limiting and throttling policies, perform protocol or message transformation, and route requests to the appropriate backend microservice-thereby preventing direct external access to each service.

A web application firewall focuses on inspecting traffic for attack patterns such as SQL injection but does not inherently provide routing, transformation, or aggregation features. A service-mesh sidecar proxy secures and observes east-west (service-to-service) traffic inside the cluster, not north-south access from external clients. Database activity monitoring solutions operate at the data layer, monitoring queries and responses, and cannot serve as an ingress gateway. Therefore, the API gateway is the appropriate architectural component for the stated requirements.