DVA-C02 Development with AWS Services Practice Question
A company is using Amazon API Gateway to expose a REST API. The API must authenticate requests using an external OAuth 2.0 provider. Which API Gateway feature should be used?
⚠ Common exam trap
Candidates often confuse Amazon Cognito User Pools with a generic OAuth 2.0 integration, but Cognito is a specific AWS-managed IdP and cannot validate tokens issued by an external OAuth 2.0 provider like Auth0 or Okta.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lambda authorizer
A Lambda authorizer (formerly known as a custom authorizer) allows you to implement custom authentication logic using an external OAuth 2.0 provider. The Lambda function receives the OAuth 2.0 bearer token from the request, validates it against the external provider's token introspection endpoint or by verifying the JWT signature, and returns an IAM policy that grants or denies access to the API Gateway method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM authorization
Why it's wrong here
AWS IAM authorization for API Gateway relies on requests being signed with AWS Signature Version 4, using AWS credentials (access key ID and secret access key) of an IAM user or role. This mechanism is designed to authenticate and authorize AWS principals accessing AWS services. It cannot be used to validate or interpret external OAuth tokens issued by a third-party identity provider, as these tokens do not contain AWS credentials and are not signed using the AWS Signature V4 process.
- ✗
Resource policy
Why it's wrong here
An API Gateway resource policy is a JSON policy document attached directly to the API, defining who can invoke the API and under what conditions, such as source IP ranges, VPC endpoints, or specific AWS accounts. While it provides granular access control at the API level, it operates on network-level attributes or AWS principal identities. A resource policy lacks the inherent programmatic capability to parse, decode, or cryptographically validate the contents of an OAuth token, making it unsuitable for authenticating users based on external tokens.
- ✓
Lambda authorizer
Why this is correct
A Lambda authorizer (formerly custom authorizer) is a powerful and flexible mechanism where API Gateway invokes a custom AWS Lambda function before forwarding the request to the backend. This Lambda function receives the incoming request's authorization header, allowing it to execute arbitrary custom logic to validate the external OAuth token. The function can perform tasks like calling an OAuth provider's introspection endpoint, verifying JWT signatures against public keys, or checking token claims, ultimately returning an IAM policy that grants or denies access to the API resources based on the token's validity.
- ✗
Amazon Cognito User Pools
Why it's wrong here
Amazon Cognito User Pools act as a managed identity provider, issuing its own JSON Web Tokens (JWTs) for authenticated users. While Cognito can federate with external identity providers (like Google, Facebook, or OIDC/SAML providers) to sign in users, an API Gateway Cognito authorizer is specifically designed to validate JWTs *issued by a Cognito User Pool*. It is not a generic mechanism to validate arbitrary OAuth tokens issued directly by any external, non-Cognito identity provider without first routing through or being issued by Cognito itself.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.