DVA-C02 Security Practice Question
A developer is building a REST API with Amazon API Gateway and needs to authorize requests based on a custom JSON Web Token (JWT) that includes claims for user roles. Which authorization mechanism should the developer use?
⚠ Common exam trap
Watch out — candidates often confuse a Lambda authorizer with a Cognito user pools authorizer, assuming any JWT can be validated by Cognito, but Cognito only accepts tokens it issued, not custom JWTs from other providers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lambda authorizer
A Lambda authorizer (formerly known as a custom authorizer) is the correct choice because it allows the developer to validate a custom JWT and extract claims such as user roles directly within the Lambda function. This enables fine-grained authorization logic that can inspect the JWT payload, verify its signature using a custom or third-party key, and return an IAM policy based on the claims, which API Gateway then enforces for the incoming request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Lambda authorizer
Why this is correct
A Lambda authorizer, formerly known as a custom authorizer, is an AWS Lambda function that API Gateway invokes before forwarding the request to the backend integration. It receives the incoming custom JWT token, validates it against custom logic (e.g., verifying signature, issuer, audience, and expiration), and then returns an IAM policy document. This policy dictates whether the principal is authorized to access the requested API Gateway method, providing ultimate flexibility for any token type.
- ✗
IAM authorizer
Why it's wrong here
The IAM authorizer integrates directly with AWS Identity and Access Management (IAM) to control access. It expects incoming requests to be signed using AWS Signature Version 4, typically by an AWS SDK or an IAM user/role. It evaluates the caller's IAM permissions against the API Gateway method's `execute-api:Invoke` action, making it unsuitable for validating arbitrary custom JWT tokens issued by external identity providers.
- ✗
Amazon Cognito user pools authorizer
Why it's wrong here
An Amazon Cognito user pools authorizer is specifically designed to validate JSON Web Tokens (JWTs) issued *only* by an Amazon Cognito User Pool. It automatically verifies the token's signature, expiration, and claims against the configured Cognito User Pool. While Cognito generates JWTs, this authorizer cannot be used to validate custom JWTs issued by a non-Cognito identity provider, as it lacks the necessary configuration to trust external issuers.
- ✗
API Gateway resource policy
Why it's wrong here
An API Gateway resource policy is an IAM policy attached directly to the API Gateway REST API itself, defining access permissions based on source IP addresses, VPC endpoints, or specific AWS accounts/IAM users/roles. It operates at the network or account level, not by inspecting or validating tokens within the request header. Therefore, it cannot be used to implement token-based authorization schemes like validating custom JWTs.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.