Exams / DVA-C02 / API authorisation and tokens / Question 3
DVA-C02 practice question: API authorisation and tokens (3 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company exposes a public REST API in Amazon API Gateway that must only accept requests coming from two corporate office IP address ranges. The developer wants to enforce this in API Gateway without changing the backend code. What should the developer use?
Choose one answer.
- AA. An API Gateway resource policy with an aws:SourceIp condition for the two ranges.
- BB. A security group attached to the API Gateway endpoint that allows the two ranges.
- CC. A usage plan with a quota and throttling limit for each office.
- DD. A Lambda authoriser that reads the X-Forwarded-For header and compares it with the ranges.
Show the answer and explanation
Answer: A
- A. Right: Correct. Resource policies can allow or deny execute-api:Invoke based on the caller's source IP address.
- B. Wrong: API Gateway public endpoints do not have security groups.
- C. Wrong: Usage plans limit request rates for API keys. They do not filter by source IP address.
- D. Wrong: This adds custom code and relies on a header that clients can set themselves, so it is weaker than a resource policy.
Explanation
API Gateway resource policies are JSON policy documents attached to an API. They can allow or deny access based on conditions such as the source IP address or the VPC endpoint the request came through. They apply before any authoriser or integration runs.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.