ANS-C01 Network Security, Compliance and Governance Practice Question
A company is building a serverless application using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The security team requires that all API requests are authenticated and authorized, and that the Lambda function has only the necessary permissions to access DynamoDB. Which THREE steps should be taken?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure API Gateway to use an Amazon Cognito user pool or a Lambda authorizer for authentication.
The correct steps are B, D, and E. Option B ensures authentication via Amazon Cognito user pools or Lambda authorizers. Option D grants the Lambda function least-privilege access to DynamoDB using an IAM role. Option E uses a resource-based policy on the DynamoDB table to restrict access to only the Lambda function's IAM role. Option A is incorrect because placing the Lambda function in a VPC is not required for security; it can access DynamoDB over the internet. Option C is incorrect because API keys are for usage plans and rate limiting, not for authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the Lambda function inside a VPC and use a VPC endpoint for DynamoDB.
Why it's wrong here
Not required; adds complexity.
- ✓
Configure API Gateway to use an Amazon Cognito user pool or a Lambda authorizer for authentication.
Why this is correct
Provides authentication.
- ✗
Use API keys in API Gateway to authenticate requests.
Why it's wrong here
API keys are for throttling, not authentication.
- ✓
Create an IAM role for the Lambda function with a policy that allows only the required DynamoDB actions.
Why this is correct
Least privilege for Lambda.
- ✓
Attach a resource-based policy to the DynamoDB table that allows access only from the Lambda function's IAM role.
Why this is correct
Restricts access to the table.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.