KCNA Cloud Native Architecture Practice Question
What is the primary purpose of an API gateway in a microservices architecture?
⚠ Common exam trap
KCNA often tests the confusion between API gateway (north-south, external entry) and service mesh (east-west, internal service-to-service), causing candidates to pick the service-mesh-related option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To act as a single entry point for external clients
The primary purpose of an API gateway in a microservices architecture is to act as a single entry point for external clients, hiding the internal service topology and centralizing concerns like routing, authentication, and rate limiting. Clients talk only to the gateway, which forwards requests to the appropriate backend microservice. This simplifies client code and allows services to evolve independently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To manage service-to-service communication within a cluster
Why it's wrong here
Service-to-service communication inside a cluster is handled by service discovery and internal networking constructs, not by an API gateway, which fronts external client traffic. An API gateway would be the right component when exposing internal services to outside consumers with routing, auth and rate limiting.
- ✗
To replace DNS for service discovery
Why it's wrong here
An API gateway does not replace DNS-based service discovery; it relies on discovery or static upstream configuration to locate backends. DNS replacement would be the role of a service registry or service mesh control plane, not the gateway itself.
- ✓
To act as a single entry point for external clients
Why this is correct
An API gateway fronts all backend microservices, routing external requests to the appropriate service while handling cross-cutting concerns such as authentication and rate limiting. This satisfies the stem's requirement for a single entry point, hiding internal service topology from external clients.
- ✗
To directly connect databases to clients
Why it's wrong here
Clients never connect directly to databases through an API gateway; the gateway routes HTTP or gRPC requests to service endpoints, and services own their data stores. Direct database connectivity would be the concern of a data access layer or backend-for-frontend, not an API gateway.
Go deeper
Related to this question
About these practice questions
This KCNA question is part of Courseiva's 930-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.