DVA-C02 Development with AWS Services Practice Question
A developer is building a REST API using Amazon API Gateway with a Lambda integration. The API must validate that the 'Authorization' header contains a valid JWT token before invoking the backend. Which approach provides the LOWEST latency for token validation?
⚠ Common exam trap
It is a common misconception that API Gateway request validation can handle JWT token validation, but it only validates structural format (e.g., header presence), not cryptographic signature verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Lambda authorizer (formerly custom authorizer) on the API Gateway.
A Lambda authorizer (formerly custom authorizer) runs before the backend Lambda invocation, caching the JWT validation result for a configurable TTL (default 300 seconds). This avoids re-validating the token on every request, providing the lowest latency for token validation compared to validating inside the backend Lambda.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a VPC Link to connect to a private server for validation.
Why it's wrong here
VPC Link is designed for private integration, allowing API Gateway to securely connect to private resources within a VPC, such as an Application Load Balancer or Network Load Balancer. It establishes a network connection for backend service communication, but it does not provide a mechanism for authenticating or authorizing API requests based on tokens. Therefore, using a VPC Link directly for token validation is an incorrect application of its intended purpose, as it's for network connectivity, not identity verification.
- ✗
Validate the token inside the Lambda function integrated with the API.
Why it's wrong here
Validating the token directly within the backend Lambda function integrated with the API introduces unnecessary latency and resource consumption. The Lambda function would be invoked for every request, even those with invalid tokens, before it can perform the validation and potentially reject the request. This approach bypasses API Gateway's robust authorization capabilities, making it less efficient and more costly than dedicated authorizer solutions that intercept requests earlier in the flow.
- ✗
Use API Gateway request validation to check the header format.
Why it's wrong here
API Gateway request validation is designed to ensure that incoming request parameters, headers, and body conform to a predefined schema or model. While it can check for the presence and format of a token in a header, it cannot perform cryptographic validation, check token expiration, or verify the token's signature against an issuer. Its purpose is structural validation, not the actual authentication or authorization based on token validity or cryptographic integrity.
- ✓
Use a Lambda authorizer (formerly custom authorizer) on the API Gateway.
Why this is correct
A Lambda authorizer, previously known as a custom authorizer, is a dedicated Lambda function invoked by API Gateway *before* the request reaches the backend integration. This authorizer receives the incoming token, performs custom validation logic (e.g., JWT signature verification, expiration checks), and returns an IAM policy that either permits or denies access to the requested API resource. Crucially, API Gateway can cache the policy generated by the authorizer, significantly reducing latency and computational overhead for subsequent requests with the same valid token.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.