easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Is a primary benefit of using an application…
Which of the following is a primary benefit of using an application programming interface (API) gateway in a microservices architecture from a security perspective?
⚠ Common exam trap
A common mix-up: candidates assume an API gateway provides comprehensive security (like a WAF) or replaces encryption, when in fact it is a centralized policy enforcement point for authentication and traffic management, not a substitute for dedicated security controls like encryption or a WAF.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It provides a centralized point for authentication and rate limiting
An API gateway acts as a single entry point for all client requests in a microservices architecture. It centralizes cross-cutting security concerns such as authentication (e.g., validating OAuth 2.0 tokens or JWT) and rate limiting (e.g., enforcing requests per second per client), offloading these tasks from individual microservices. This reduces attack surface and ensures consistent enforcement of security policies across the entire system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It eliminates the need for encryption
Why it's wrong here
An API Gateway acts as an intermediary for API traffic, but it does not inherently secure the data payload itself. Encryption, typically TLS/SSL, remains crucial for protecting data confidentiality and integrity both between the client and the gateway, and often between the gateway and the backend services. Eliminating encryption would expose sensitive information to eavesdropping and tampering, regardless of the gateway's presence, violating fundamental security principles.
- ✗
It replaces the need for a web application firewall
Why it's wrong here
While an API Gateway can perform some basic security functions like authentication and rate limiting, it does not replace the specialized protection offered by a Web Application Firewall (WAF). A WAF specifically analyzes HTTP/S traffic for common web-based attacks, such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 vulnerabilities, operating at Layer 7 to protect the application logic itself. API Gateways primarily manage API traffic flow and policy enforcement, making them complementary to WAFs.
- ✗
It allows direct database access to services
Why it's wrong here
An API Gateway is designed to provide a secure, abstracted interface to backend services, not to facilitate direct database access. Allowing services to directly access databases through an API Gateway would bypass critical security controls, increase the attack surface, and violate the principle of least privilege. Instead, the gateway routes requests to specific microservices or backend APIs, which then interact with their respective data stores in a controlled and authorized manner, maintaining proper architectural separation.
- ✓
It provides a centralized point for authentication and rate limiting
Why this is correct
A primary benefit of an API Gateway is its ability to serve as a centralized enforcement point for critical security and operational policies. By handling authentication and authorization at the gateway, individual backend services do not need to implement these mechanisms redundantly, simplifying development and ensuring consistent policy application. Similarly, rate limiting prevents abuse and denial-of-service attacks by controlling the number of requests an API can receive within a given timeframe, all managed efficiently from a single location.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.