DVA-C02 Development with AWS Services Practice Question
Which TWO of the following are required to enable cross-origin resource sharing (CORS) for an API hosted on Amazon API Gateway? (Choose two.)
⚠ Common exam trap
Candidates often think modifying the Lambda function to return CORS headers is sufficient, but they forget that the browser's preflight OPTIONS request must be handled separately, and without an OPTIONS method on the API Gateway resource, the preflight will fail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an OPTIONS method to the API Gateway resource and configure it to return the required CORS headers
CORS requires a preflight OPTIONS request to determine if the actual request is safe to send. By adding an OPTIONS method to the API Gateway resource and configuring it to return the required CORS headers (such as Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers), the API can respond to the browser's preflight request and enable cross-origin requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the Lambda function to return CORS headers in the response
Why it's wrong here
While a Lambda function can technically return CORS headers in its response, it is not the primary or most efficient method for enabling CORS for an API Gateway endpoint. API Gateway itself provides built-in mechanisms to handle CORS, including preflight OPTIONS requests and injecting necessary headers, thereby offloading this responsibility from the backend compute layer. Relying solely on Lambda for CORS headers would also make the function less portable and introduce redundant logic.
- ✗
Configure Amazon CloudFront to add CORS headers
Why it's wrong here
Amazon CloudFront operates as a Content Delivery Network (CDN) and can be configured to add or modify HTTP headers, but its role is not to enable Cross-Origin Resource Sharing (CORS) for the origin server, which in this case is API Gateway. CORS is a browser security feature enforced based on headers received directly from the origin. Configuring CloudFront headers would not satisfy the browser's requirement for CORS headers from API Gateway itself.
- ✓
Add an OPTIONS method to the API Gateway resource and configure it to return the required CORS headers
Why this is correct
Browsers perform an HTTP OPTIONS 'preflight' request before certain cross-origin requests (e.g., those using non-simple methods or custom headers). To enable CORS, API Gateway must explicitly respond to these OPTIONS requests with the appropriate `Access-Control-Allow-*` headers. Manually adding an OPTIONS method to the resource and configuring its integration response to return these specific headers is a fundamental and correct way to satisfy the CORS preflight requirement.
- ✗
Configure an S3 bucket CORS policy
Why it's wrong here
An S3 bucket CORS policy is specifically designed to control cross-origin access to objects stored within that particular S3 bucket. This policy is entirely distinct and irrelevant to enabling CORS for an API Gateway endpoint, which is a separate AWS service. API Gateway requires its own dedicated CORS configuration to manage cross-origin requests directed at its API resources, independent of any S3 policies.
- ✓
Enable CORS on the API Gateway resource and deploy the API
Why this is correct
API Gateway offers a streamlined feature to automatically enable CORS for a selected resource. By utilizing the 'Enable CORS' option in the console or equivalent API/CLI commands, API Gateway will automatically generate an OPTIONS method, configure its integration response with the required `Access-Control-Allow-*` headers, and set up the necessary method responses. Deploying the API after this configuration makes these CORS settings live, allowing browsers to successfully execute cross-origin requests.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.