DVA-C02 Development with AWS Services Practice Question
This DVA-C02 practice question tests your understanding of development with aws services. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: native JWT authorizers are available for API Gateway HTTP APIs.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is building a RESTful API using Amazon API Gateway and AWS Lambda. The API must allow users to authenticate using an identity provider that supports OpenID Connect (OIDC). The developer wants to offload authentication and authorization to API Gateway. Which API Gateway feature should the developer use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Native JWT authorizer (HTTP API)
Option C is correct because the Native JWT authorizer for HTTP APIs in API Gateway directly validates JSON Web Tokens (JWTs) from an OIDC-compliant identity provider without requiring custom code. This offloads both authentication and authorization to API Gateway by configuring the issuer URL and audience, matching the requirement to use an OIDC provider.
Key principle: Native JWT authorizers are available for API GatewayHTTP APIs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Amazon Cognito User Pools authorizer
Why it's wrong here
Cognito User Pools is an OIDC-compatible provider but not generic; the question does not specify using Cognito.
✗
Custom Lambda authorizer
Why it's wrong here
Lambda authorizers can validate OIDC tokens but require custom code; API Gateway native JWT authorizer is simpler.
✓
Native JWT authorizer (HTTP API)
Why this is correct
API GatewayHTTP APIs support JWT authorizers that can validate tokens from any OIDC identity provider.
Related concept
Native JWT authorizers are available for API GatewayHTTP APIs.
✗
AWS IAM authorizer
Why it's wrong here
IAM authorizer uses AWS SigV4 signatures, not OIDC tokens.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the Native JWT authorizer (available only for HTTP APIs) with the Cognito User Pools authorizer (available for REST APIs), assuming any OIDC provider requires a Lambda authorizer or Cognito integration.
Detailed technical explanation
How to think about this question
The Native JWT authorizer works by configuring the `issuer` (the OIDC provider's token endpoint) and `audience` (the intended recipient of the token) in the API GatewayHTTP API settings. API Gateway automatically fetches and caches the OIDC provider's JWKS (JSON Web Key Set) to verify the token's signature, expiry, and claims, enabling token-based authorization without any Lambda invocation. This is ideal for scenarios like integrating with Auth0, Okta, or Azure AD where you want to minimize custom code and reduce latency.
KKey Concepts to Remember
Native JWT authorizers are available for API Gateway HTTP APIs.
They validate JWTs from any OIDC-compliant identity provider.
Configuration involves specifying the issuer URL and audience.
Authentication and authorization are offloaded to API Gateway.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Native JWT authorizers are available for API Gateway HTTP APIs.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review native JWT authorizers are available for API Gateway HTTP APIs., then practise related DVA-C02 questions on the same topic to reinforce the concept.
Development with AWS Services — This question tests Development with AWS Services — Native JWT authorizers are available for API Gateway HTTP APIs..
What is the correct answer to this question?
The correct answer is: Native JWT authorizer (HTTP API) — Option C is correct because the Native JWT authorizer for HTTP APIs in API Gateway directly validates JSON Web Tokens (JWTs) from an OIDC-compliant identity provider without requiring custom code. This offloads both authentication and authorization to API Gateway by configuring the issuer URL and audience, matching the requirement to use an OIDC provider.
What should I do if I get this DVA-C02 question wrong?
Review native JWT authorizers are available for API Gateway HTTP APIs., then practise related DVA-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Native JWT authorizers are available for API Gateway HTTP APIs.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.