DVA-C02 Development with AWS Services Practice Question
A developer is building a RESTful API using Amazon API Gateway and AWS Lambda. The API needs to support custom domain names with SSL/TLS certificates. The developer has created the custom domain name in API Gateway and uploaded the certificate to AWS Certificate Manager (ACM) in the same region. However, when accessing the custom domain, users get an SSL error. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to confuse SSL errors with API configuration issues like missing stage mappings or incorrect certificate authorities, but SSL errors occur at the transport layer due to DNS misconfiguration or certificate domain mismatch, not at the application layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The custom domain name's DNS record does not point to API Gateway's regional domain name.
The most likely cause is that the custom domain name's DNS record does not point to API Gateway's regional domain name. When using a custom domain name with API Gateway, you must create a DNS record (typically a CNAME or A record using Route 53 alias) that maps your custom domain to the API Gateway-generated regional domain name (e.g., d-xxxxx.execute-api.region.amazonaws.com). Without this correct DNS mapping, the SSL/TLS handshake fails because the certificate presented by API Gateway does not match the domain name the client is connecting to, resulting in an SSL error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The certificate was not issued by a trusted certificate authority.
Why it's wrong here
AWS Certificate Manager (ACM) provisions certificates from a trusted Amazon Certificate Authority, which is inherently recognized by web browsers and operating systems. Therefore, a certificate issued by ACM for a custom domain will always be considered trusted and valid. If the certificate *were* untrusted, clients would typically encounter a browser warning about an invalid or self-signed certificate, indicating a trust issue, rather than a direct SSL handshake failure related to the domain mapping itself.
- ✓
The custom domain name's DNS record does not point to API Gateway's regional domain name.
Why this is correct
For a custom domain to function with API Gateway, its DNS record (typically a CNAME or an ALIAS record in Route 53) must correctly resolve to the API Gateway's regional endpoint domain name. If the DNS record is misconfigured or missing, client requests will not reach the API Gateway endpoint associated with the custom domain. Consequently, the server presenting the certificate (which would be the API Gateway) cannot be found at the requested custom domain, leading to an SSL handshake failure as the client cannot establish a secure connection with the intended server.
- ✗
The API Gateway API is not deployed to a stage that is mapped to the custom domain name.
Why it's wrong here
A missing stage mapping between the custom domain and a deployed API Gateway stage means that while the client might successfully connect via SSL to the API Gateway endpoint, the API Gateway itself cannot find a resource to serve for the requested path. This scenario typically results in HTTP 404 Not Found errors or potentially "Missing Authentication Token" if the request reaches a default handler, rather than an SSL/TLS handshake failure, as the secure connection itself would have already been established.
- ✗
The certificate is in the wrong region relative to the API Gateway regional endpoint.
Why it's wrong here
When configuring a custom domain name in API Gateway, the associated AWS Certificate Manager (ACM) certificate must reside in the *same AWS region* as the API Gateway regional endpoint. If the certificate were in a different region, API Gateway would fail to validate or associate it during the custom domain setup process itself, preventing the custom domain from being configured at all. This issue would manifest as a configuration error during setup, not a runtime SSL handshake failure for an already configured domain.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.