SAA-C03 Design Secure Architectures Practice Question
A public API for a customer analytics portal is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?
⚠ Common exam trap
Many candidates confuse API keys (which are static and not standards-based) with JWT tokens (which are cryptographically signed and verifiable), or assume IAM authorization can be used for external identities without understanding that IAM requires AWS credentials, not OIDC tokens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
JWT authorizer configured for the OpenID Connect issuer
The scenario requires standards-based token authentication from an external OpenID Connect (OIDC) provider. API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by OIDC providers by verifying the token's signature against the provider's JWKS endpoint, checking the `iss` and `aud` claims, and enforcing token expiration. This directly meets the requirement without needing custom Lambda authorizers or additional infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
API keys only
Why it's wrong here
API keys are static shared secrets, so they cannot validate OIDC-issued JWTs or their signatures, issuer, or expiry. They suit simple usage plans and rate limiting for trusted internal callers, not standards-based token authentication from an external identity provider.
- ✓
JWT authorizer configured for the OpenID Connect issuer
Why this is correct
A JWT authorizer validates the token signature against the OpenID Connect issuer's published JWKS and checks claims such as audience and expiry. This satisfies the requirement that clients authenticate with standards-based tokens from an external OpenID Connect provider, which IAM authorization or API keys cannot validate.
- ✗
IAM authorization for all internet users
Why it's wrong here
IAM authorization requires callers to sign requests with AWS SigV4 credentials, which external OpenID Connect clients holding standards-based tokens cannot produce. It is tempting because IAM auth suits AWS-internal service-to-service calls or users federated into IAM roles, not public API consumers presenting third-party OIDC tokens.
- ✗
A VPC endpoint policy
Why it's wrong here
A VPC endpoint policy governs which principals may reach the API through a private endpoint, not token validation. It is the right control for restricting private VPC access to an API, but the portal's clients are public and authenticate with OIDC tokens.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.