DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless API using Amazon API Gateway and AWS Lambda. The API accepts JSON payloads in the request body. The developer wants to ensure that incoming requests have a valid structure before being passed to the Lambda function to reduce unnecessary invocations. Which API Gateway feature should the developer use?
⚠ Common exam trap
A common mix-up: candidates confuse request validation (payload structure checking) with authorization (who can call the API) or security filtering (WAF), leading them to pick a wrong option like custom authorizer or WAF integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Request validation using models and request validators
API Gateway's request validation feature allows you to define a JSON Schema model for the request body and attach a request validator to the method. This validates the payload structure before the request reaches the Lambda function, preventing invalid payloads from triggering unnecessary invocations and reducing costs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Request validation using models and request validators
Why this is correct
API Gateway's request validation feature directly addresses the need to validate the structure and data types of incoming request payloads. By defining a Model, which is essentially a JSON schema, and associating it with a Method's request body, API Gateway automatically checks the request against this schema. Invalid requests, such as those with missing required fields or incorrect data types, are rejected with a 400 Bad Request error *before* the request reaches the backend integration, significantly reducing unnecessary Lambda invocations and operational costs.
- ✗
Usage plans with API keys
Why it's wrong here
Usage plans in API Gateway are designed to manage access, throttling, and quota limits for API clients, typically enforced via API keys. They allow developers to define how many requests a client can make within a given period and the overall request volume. However, usage plans operate at the request metadata level (e.g., request count, rate) and do not inspect or validate the structural integrity or content of the request body payload itself.
- ✗
WAF (AWS WAF) integration
Why it's wrong here
AWS WAF (Web Application Firewall) is primarily a security service that protects web applications and APIs from common web exploits and bot traffic, such as SQL injection, cross-site scripting (XSS), and DDoS attacks. While WAF can inspect parts of the HTTP request, including headers and body content for malicious patterns, it is not designed to perform structural validation of JSON schemas or enforce data type correctness within an API request payload. Its rules focus on threat detection, not data model compliance.
- ✗
Custom authorizer (Lambda authorizer)
Why it's wrong here
A Custom Authorizer, often implemented as a Lambda function, is used in API Gateway to control access to API methods by validating incoming authentication tokens (e.g., JWTs, OAuth tokens) or other custom authorization schemes. Its primary function is to determine if a client is authorized to invoke a specific API resource. While a Lambda authorizer *could* technically inspect the request body, its intended and efficient use case is for authentication and authorization, not for validating the structural integrity or data types of the request payload against a defined schema.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.