DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API will be consumed by a web application hosted on a different domain. The developer needs to enable Cross-Origin Resource Sharing (CORS) for all HTTP methods. What is the most efficient way to achieve this?
⚠ Common exam trap
Many candidates assume adding CORS headers only in the Lambda function code is sufficient, overlooking the mandatory preflight OPTIONS request that API Gateway must handle separately.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CORS on the API Gateway resource using the 'Enable CORS' feature in the API Gateway console, which adds the OPTIONS method and appropriate headers.
API Gateway's 'Enable CORS' feature automatically creates an OPTIONS method for the selected resource and configures the necessary response headers (e.g., Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to handle preflight requests. This is the most efficient approach as it centralizes CORS configuration at the API Gateway layer, eliminating the need for manual header management in Lambda or additional infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable CORS on the API Gateway resource using the 'Enable CORS' feature in the API Gateway console, which adds the OPTIONS method and appropriate headers.
Why this is correct
Enabling CORS directly on the API Gateway resource is the correct and most efficient solution. API Gateway's built-in CORS feature automatically configures the necessary preflight OPTIONS method for the resource. It also injects the required Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers into the method responses and integration responses, ensuring browsers can successfully make cross-origin requests to your API.
- ✗
In the Lambda function code, add the 'Access-Control-Allow-Origin' header to every response.
Why it's wrong here
While adding CORS headers in Lambda is necessary, it alone is not sufficient. The browser sends a preflight OPTIONS request that must be handled by API Gateway before the Lambda is invoked. Without an OPTIONS method configured, the preflight will fail.
- ✗
Configure Amazon CloudFront in front of API Gateway to handle CORS.
Why it's wrong here
Configuring Amazon CloudFront in front of API Gateway does not inherently 'handle' CORS in the sense of generating preflight responses or adding the required `Access-Control-Allow-Origin` headers. While CloudFront can be configured to forward specific headers, the origin (API Gateway) must still be properly configured to *produce* those CORS headers. Relying on CloudFront for this specific task adds unnecessary complexity without addressing the fundamental requirement for CORS configuration at the API Gateway level.
- ✗
Set a bucket policy on the S3 bucket that hosts the web application to allow cross-origin requests.
Why it's wrong here
Setting a bucket policy on the S3 bucket that hosts the web application is irrelevant for enabling CORS on an API Gateway. S3 bucket policies control access permissions to the objects stored within the S3 bucket itself, dictating who can read, write, or delete them. They do not influence the cross-origin resource sharing behavior of a separate service like API Gateway, which acts as the origin for the API requests.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.