DVA-C02 Development with AWS Services Practice Question
A company is using Amazon API Gateway to expose a set of RESTful APIs. Each API call is processed by an AWS Lambda function. The company wants to enforce throttling limits to prevent abuse. Specifically, the company wants to allow 100 requests per second per API key. What is the SIMPLEST way to achieve this?
⚠ Common exam trap
Many exam-takers confuse reserved concurrency (which limits Lambda execution concurrency) with API-level rate limiting, or assume that a reactive solution like CloudWatch alarms can enforce proactive throttling, when in fact API Gateway usage plans provide the simplest and most direct mechanism for per-API-key rate control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.
API Gateway usage plans are specifically designed to enforce throttling limits per API key. By creating a usage plan with a rate limit of 100 requests per second and associating it with the desired API keys, you can directly control request rates at the API Gateway layer without additional services or custom logic. This is the simplest and most native approach for per-API-key throttling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS WAF to block requests after 100 per second.
Why it's wrong here
AWS WAF is designed to protect web applications from common web exploits and can implement rate-based rules to block requests from specific IP addresses that exceed a threshold. However, WAF lacks the native capability to identify and throttle requests based on individual API Gateway API keys. It cannot differentiate between requests originating from the same IP but using different API keys, making it unsuitable for enforcing a per-key limit.
- ✗
Set a reserved concurrency on the Lambda function to 100.
Why it's wrong here
Setting reserved concurrency on a Lambda function limits the total number of concurrent executions for that specific function across all invocations. This is a global limit applied to the backend compute resource, not a per-API-key throttling mechanism. It would prevent the Lambda function from scaling beyond 100, but it would not enforce individual limits for each API key, potentially impacting all users if one key consumes the entire concurrency.
- ✗
Configure a CloudWatch alarm to disable the API key after exceeding the limit.
Why it's wrong here
CloudWatch alarms are reactive monitoring tools that trigger actions *after* a metric threshold has been breached for a specified period. This makes them unsuitable for real-time, proactive throttling, as requests would already have passed the limit before any action, like disabling an API key, could be taken. A CloudWatch alarm would provide a delayed response rather than preventing excess requests in real-time.
- ✓
Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.
Why this is correct
API Gateway usage plans are specifically designed to control access to API stages and methods by defining throttling and quota limits for individual API keys. By associating an API key with a usage plan, you can enforce precise rate limits, such as 100 requests per second, and burst limits on a per-consumer basis. This provides real-time, fine-grained control over API consumption, ensuring fair usage and protecting backend resources.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.