DVA-C02 Development with AWS Services Practice Question
A company uses Amazon API Gateway to expose a REST API. The API uses a Lambda authorizer to validate JWT tokens. Recently, the API has been returning 401 Unauthorized errors for valid tokens. The developer notices that the tokens are signed with a new key but the authorizer still uses the old key. What is the MOST efficient way to update the authorizer with the new key?
⚠ Common exam trap
Watch out — candidates often assume updating environment variables or redeploying the API is sufficient, but they overlook that the authorizer must dynamically resolve the signing key to handle automatic key rotation without manual steps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the Lambda authorizer to fetch the public key from a well-known URL at runtime.
Fetching the public key from a well-known URL (e.g., the JWKS endpoint) at runtime allows the Lambda authorizer to automatically use the latest signing key without manual intervention. This approach decouples key rotation from the authorizer code, ensuring that valid tokens signed with the new key are accepted immediately. It is the most efficient method as it avoids redeployments, environment variable updates, or recreating the authorizer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the Lambda authorizer to fetch the public key from a well-known URL at runtime.
Why this is correct
Modifying the Lambda authorizer to fetch the public key from a well-known URL at runtime is the most robust solution. This approach leverages standard identity provider practices where public keys (often in JWKS format) are exposed at a predictable endpoint (e.g., `/.well-known/jwks.json`). The Lambda function can programmatically retrieve and cache these keys, ensuring it always uses the latest valid key for JWT signature verification without requiring any redeployment of the Lambda function or API Gateway when the key rotates. This significantly reduces operational overhead and enhances security by enabling seamless key rotation.
- ✗
Update the API Gateway stage deployment to redeploy the API.
Why it's wrong here
Updating an API Gateway stage deployment only publishes the current configuration snapshot of the API to a specific stage. While this includes the *reference* to the Lambda authorizer, it does not trigger any re-initialization or re-reading of configuration *within* the Lambda function itself. Therefore, if the public key is stored as an environment variable or hardcoded within the Lambda authorizer's code, a stage redeployment will not update the key used for token validation, rendering this action ineffective for key rotation.
- ✗
Delete and recreate the API Gateway authorizer with the new key.
Why it's wrong here
Deleting and recreating the API Gateway authorizer is a highly disruptive and inefficient method for updating a public key. Deleting the authorizer immediately invalidates all API methods configured to use it, causing immediate downtime and service interruption for clients. Recreating it necessitates manually re-associating the new authorizer with every affected API method, which is a tedious, error-prone, and time-consuming process, especially for large APIs. This approach should be avoided due to its significant operational impact and potential for errors.
- ✗
Update the Lambda authorizer's environment variable with the new key and publish a new version.
Why it's wrong here
Updating the Lambda authorizer's environment variable with the new key and publishing a new version will technically update the key used by the authorizer. However, this method requires a manual deployment process every single time the public key rotates. This introduces significant operational overhead and potential delays, making it less efficient and scalable than a dynamic key retrieval mechanism. While functional, it does not align with best practices for automated and seamless key management in a dynamic environment.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.