DVA-C02 Development with AWS Services Practice Question
A developer is creating a REST API using Amazon API Gateway and multiple AWS Lambda functions for different endpoints. The API must support CORS for a web application hosted on a different domain. The developer is using Lambda proxy integration. Which configuration is required to enable CORS?
⚠ Common exam trap
Watch out — candidates often assume API Gateway's CORS configuration works universally, but with Lambda proxy integration, the Lambda function has full control over the response headers, making API Gateway's CORS settings ineffective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CORS in API Gateway and configure the Lambda functions to return the required CORS headers.
With Lambda proxy integration in API Gateway, the entire request and response are passed through to the Lambda function, which must return the HTTP response including status code, headers, and body. To enable CORS, the Lambda function must include the required CORS headers (e.g., Access-Control-Allow-Origin) in its response. While API Gateway can be configured to add CORS headers for non-proxy integrations, with proxy integration the Lambda function is solely responsible for returning all headers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable CORS in API Gateway and configure the Lambda functions to return the required CORS headers.
Why this is correct
Enabling CORS in API Gateway generates an OPTIONS method and configures headers for non-proxy integrations, but for proxy integrations, the Lambda must also return the headers. Both steps are needed to ensure full CORS support.
- ✗
Configure API Gateway to return CORS headers and Lambda functions can ignore CORS.
Why it's wrong here
When utilizing API Gateway's Lambda proxy integration, API Gateway acts as a direct passthrough, forwarding the Lambda function's entire response, including all headers, directly to the client. If the Lambda function does not explicitly include the necessary CORS headers, such as `Access-Control-Allow-Origin`, the browser will receive a response lacking these critical security attributes. Consequently, the browser's same-origin policy will block the cross-origin request, rendering any CORS settings configured solely within API Gateway's integration response for non-proxy scenarios ineffective.
- ✗
Configure Lambda functions to return CORS headers and API Gateway will pass them through automatically.
Why it's wrong here
Browsers initiate cross-origin requests with a preflight `OPTIONS` request to determine if the actual request is safe to send, checking for allowed methods and headers. Even if a Lambda function is configured to return the correct CORS headers for the main HTTP method (e.g., GET or POST), the browser will first send an `OPTIONS` request to the API Gateway endpoint. Without API Gateway explicitly configured to respond to this `OPTIONS` method, typically by enabling CORS on the resource, the preflight request will fail, preventing the actual request from ever being sent to the Lambda function.
- ✗
Use a Lambda@Edge function at Amazon CloudFront to add CORS headers.
Why it's wrong here
While technically feasible to use a Lambda@Edge function with Amazon CloudFront to inject CORS headers into responses, this approach introduces unnecessary complexity and additional infrastructure for a problem natively addressed by API Gateway and Lambda. API Gateway provides built-in mechanisms to handle CORS, including generating `OPTIONS` methods and configuring integration responses, making it the simpler and more direct solution. Leveraging Lambda@Edge for this purpose would incur extra cost, increase latency, and complicate the overall architecture without providing significant benefit over native integration.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.