A single weak entry can open your whole system.
To give you an idea on what you will learn, i am listing some of the diagrams taken from the guide.
Modern systems place a public website in front of APIs, storage, and databases. In many cloud defaults, not only the site but also secondary services are internet-reachable.
Place a gateway in front. It is the only internet-facing component. It validates and sanitizes requests, then forwards acceptable traffic to trusted hosts through protected, internal endpoints.
Secondary services (API app, storage, database) live in a virtual network and are reachable only from the web app.