DVA-C02 Development with AWS Services Practice Question
A developer is using Amazon API Gateway to create a REST API. The API must support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. What must the developer do to enable CORS?
⚠ Common exam trap
Candidates often assume API Gateway automatically handles CORS (Option C) or that adding headers only in the Lambda function is sufficient (Option D), forgetting that the browser's preflight OPTIONS request must be handled by API Gateway itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CORS in the API Gateway settings and configure the required headers.
Enabling CORS in API Gateway requires explicit configuration: you must enable CORS on the API Gateway resource, which automatically generates an OPTIONS method and adds the necessary CORS headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to responses. This is done through the API Gateway console or API configuration, not by the backend Lambda function or CloudFront.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon CloudFront to proxy the API and add CORS headers.
Why it's wrong here
While Amazon CloudFront can be configured to add HTTP headers, including CORS headers, it is an unnecessary and overly complex solution for enabling Cross-Origin Resource Sharing (CORS) for an API Gateway REST API. API Gateway provides built-in functionality specifically designed to handle CORS preflight requests and inject the necessary headers directly into responses. Using CloudFront primarily for CORS adds latency and operational overhead without providing additional benefits over API Gateway's native feature.
- ✓
Enable CORS in the API Gateway settings and configure the required headers.
Why this is correct
API Gateway provides a dedicated feature to enable Cross-Origin Resource Sharing (CORS) directly within its console or via infrastructure as code. This involves configuring the `OPTIONS` method for resources, specifying allowed origins, methods, and headers, and ensuring the necessary `Access-Control-Allow-*` headers are automatically included in responses. This native capability simplifies CORS management, allowing the API Gateway to handle preflight requests and inject the required headers without custom backend logic.
- ✗
Nothing; API Gateway automatically handles CORS.
Why it's wrong here
API Gateway does not automatically handle Cross-Origin Resource Sharing (CORS) by default. CORS is a security mechanism that requires explicit configuration to allow web browsers to make requests to a different domain than the one that served the web page. Without explicit configuration, API Gateway will not include the necessary `Access-Control-Allow-Origin` and other CORS headers, leading to browser security errors for cross-origin requests.
- ✗
Add CORS headers in the Lambda function code.
Why it's wrong here
While it is technically possible to add CORS headers within the backend Lambda function code, this approach is generally not recommended for API Gateway REST APIs. API Gateway is designed to manage Cross-Origin Resource Sharing (CORS) at the API level, handling preflight `OPTIONS` requests and injecting `Access-Control-Allow-*` headers before the request even reaches the backend integration. Relying on Lambda for CORS headers couples presentation concerns with business logic and can be less efficient, especially for `OPTIONS` requests that don't need to invoke the backend.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.