DVA-C02 API Gateway API Key Practice Question
A developer is using Amazon S3 to host a static website. The website uses JavaScript to fetch data from an API Gateway endpoint. Users report that the website loads but API calls fail with HTTP 403 errors. The developer checks the S3 bucket policy and finds it allows public read access. What is the most likely cause?
⚠ Common exam trap
Candidates often confuse CORS issues with API key requirements. While CORS can cause errors, a 403 Forbidden error from API Gateway often indicates that an API key is required but not provided. The trap is to assume it is a CORS problem without checking the API key requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The API Gateway API key is not included in the JavaScript code.
The website loads from S3, but the API calls to API Gateway fail with 403. This is often due to missing API key. If the API Gateway endpoint requires an API key and the JavaScript code does not include it in the request headers, API Gateway returns a 403 Forbidden error. Option C is correct because the most likely cause is that the API key is not included in the JavaScript code, leading to the 403 response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket policy blocks access from the API Gateway domain.
Why it's wrong here
An S3 bucket policy is designed to control access permissions for objects stored within that specific S3 bucket, dictating who can read, write, or delete S3 content. It has no jurisdiction over requests directed to an API Gateway endpoint, which is a distinct AWS service with its own authorization mechanisms. Consequently, an S3 bucket policy cannot block or influence requests made to an API Gateway domain.
- ✗
The S3 bucket is not configured for static website hosting.
Why it's wrong here
If a static website hosted on Amazon S3 successfully loads in a browser, it confirms that the S3 bucket is correctly configured for static website hosting. The issue described, an API call failure (e.g., 403 Forbidden), originates from the JavaScript code making a request to an external API Gateway endpoint, not from the S3 bucket's ability to serve its own content. Therefore, the S3 hosting configuration is not the cause of the API call failure.
- ✓
The API Gateway API key is not included in the JavaScript code.
Why this is correct
When an API Gateway method is configured to require an API key, every incoming request must include a valid `x-api-key` header. If the JavaScript code making the API call omits this essential header, or provides an incorrect or expired key, API Gateway will reject the request with a `403 Forbidden` status code. This indicates that the request reached API Gateway but was denied due to a lack of proper authentication credentials.
- ✗
The S3 bucket does not have CORS configuration to allow cross-origin requests from the API Gateway domain.
Why it's wrong here
CORS configuration for cross-origin requests should be enabled on API Gateway, not on S3. Missing CORS on API Gateway might cause issues, but the more common cause for 403 with API Gateway is a missing API key. Additionally, the option incorrectly states that S3 needs CORS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.