ExamPark
Course menuDVA-C03

Exams / DVA-C03 / API authorization and tokens / Question 3

DVA-C03 practice question: API authorization and tokens (3 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A company publishes a REST API in Amazon API Gateway for its partners' internal tools.

Only requests from the partners' two office ranges, 203.0.113.0/24 and 198.51.100.0/24, may reach the API. All other callers must be rejected by API Gateway before the Lambda backend runs. The backend code must not change, and the company does not want to add more AWS services.

What should the developer do?

Choose one answer.

  1. A. Add a Lambda authorizer that compares the X-Forwarded-For header with the two ranges and returns a Deny policy otherwise.
  2. B. Associate a security group that allows only the two ranges with the API's regional endpoint.
  3. C. Attach a resource policy to the API that denies execute-api:Invoke unless aws:SourceIp is within the two ranges.
  4. D. Issue an API key for each office, add each to a usage plan and require an API key on every method.
Show the answer and explanation

Answer: C

  • A. Wrong: This adds a Lambda function to build and run on each request, and the X-Forwarded-For header can be set by the caller, so it is not a trustworthy source address. A resource policy checks the real source address natively. Learn more: Lambda authorizers for REST APIs (opens in a new tab)
  • B. Wrong: Security groups attach to network interfaces such as EC2 instances and load balancers, not to API Gateway APIs. API Gateway offers resource policies for restricting source IP addresses.
  • C. Right: Correct. API Gateway resource policies can allow or deny access by source IP address, and API Gateway enforces them before the request reaches the backend. No code or extra service is needed. Learn more: API Gateway resource policy examples (opens in a new tab)
  • D. Wrong: API keys limit and meter usage, but they do not check where a request came from, and the key could be used from any address. They are not an access control mechanism. Learn more: Controlling access to REST APIs (opens in a new tab)

Explanation

An API Gateway resource policy can allow or deny invocation by source IP using the aws:SourceIp condition, and it is enforced by API Gateway before any backend runs. A Lambda authorizer would add code and rely on a spoofable header, security groups do not apply to API Gateway, and API keys are for usage tracking.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice API authorization and tokensAll API authorization and tokens questions

Want more on API authorization and tokens? The 5 full-length practice sets have 15 more API authorization and tokens questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets