DVA-C02 Lambda authorizer Practice Question
A developer needs to securely expose an API running on an EC2 instance behind an Application Load Balancer. The API should only be accessible to authenticated users via a custom authorization header. Which steps should be taken? (Choose TWO.)
⚠ Common exam trap
The trap is that candidates may assume ALB can use Lambda authorizers similar to API Gateway, but ALB lacks this feature. The correct solution is to use API Gateway with a Lambda authorizer instead of relying on ALB for custom authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Lambda authorizer that validates the custom header
It creates a Lambda authorizer that can validate a custom authorization header. Option D is correct because API Gateway natively supports Lambda authorizers, allowing the custom header validation to secure the API. Options B and C are incorrect because AWS WAF cannot perform custom authorization logic, and Cognito User Pools require OIDC flows, not custom headers. Option E is incorrect because ALB does not natively support Lambda authorizers as a feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Lambda authorizer that validates the custom header
Why this is correct
Correct. A Lambda authorizer can validate a custom authorization header and return an IAM policy, which API Gateway uses to allow or deny access.
- ✗
Enable AWS WAF on the ALB to inspect the header
Why it's wrong here
Incorrect. AWS WAF can inspect headers but cannot execute custom authorization logic; it is rule-based, not decision-based on header content.
- ✗
Use Amazon Cognito User Pools to validate the header
Why it's wrong here
Incorrect. Amazon Cognito User Pools are used for user authentication via OAuth/OIDC, not for validating arbitrary custom headers.
- ✓
Use Amazon API Gateway instead of ALB
Why this is correct
Correct. API Gateway can be placed in front of the EC2 instance, replacing the ALB, and can use a Lambda authorizer to secure the API.
- ✗
Configure the ALB to use the Lambda authorizer
Why it's wrong here
Incorrect. ALB does not natively support Lambda authorizers; it can invoke a Lambda as a target but not as an authorizer for access control.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.