SAP-C02 Design for New Solutions Practice Question
A company is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API must be secured using AWS WAF. Which TWO actions should the company take to integrate WAF with API Gateway? (Choose TWO.)
⚠ Common exam trap
Many exam-takers think WAF must be attached to a CloudFront distribution or a Lambda function, but AWS WAF directly supports association with both API Gateway REST API stages and HTTP APIs without requiring CloudFront.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate an AWS WAF web ACL with the API Gateway HTTP API
Options C and D are correct because AWS WAF web ACLs can be directly associated with API Gateway REST API stages and with API Gateway HTTP APIs, which is the supported way to protect these endpoints with WAF rules. For a REST API, the web ACL is attached at the stage level (for example, via the API Gateway console, AWS CLI, or CloudFormation), and for an HTTP API, the web ACL is associated with the API itself. Option A is incorrect because AWS WAF cannot be attached directly to a Lambda function; Lambda is protected only indirectly through the fronting service. Option B is incorrect because API keys and usage plans handle throttling and identification, not WAF rule enforcement, and WAF is not associated with usage plans. Option E is incorrect because placing WAF in front of CloudFront and using CloudFront as the API Gateway endpoint is not the required or direct integration method for securing API Gateway with WAF.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an AWS WAF web ACL and attach it to the Lambda function
Why it's wrong here
AWS WAF web ACLs can only be associated with CloudFront distributions, Application Load Balancers, API Gateway stages, or AppSync, never Lambda functions directly. Attaching to Lambda is tempting because WAF filters HTTP traffic, but Lambda receives events, not inspectable web requests.
- ✗
Configure API Gateway to require an API key and associate WAF with the usage plan
Why it's wrong here
API keys and usage plans handle client identification and throttling, not Layer 7 attack filtering; WAF cannot be associated with a usage plan. API keys suit quota enforcement and basic caller tracking, whereas WAF web ACLs must attach to the API Gateway stage itself.
- ✓
Associate an AWS WAF web ACL with the API Gateway HTTP API
Why this is correct
AWS WAF web ACLs can be associated directly with API Gateway HTTP APIs, filtering requests at the API endpoint before they reach the backend. This satisfies the requirement to secure the API with WAF, though the association is configured on the HTTP API rather than a REST stage.
- ✓
Associate an AWS WAF web ACL with the API Gateway REST API stage
Why this is correct
For REST APIs, AWS WAF web ACLs are associated with the API Gateway stage, filtering traffic at that deployed stage before requests reach Lambda. This satisfies the requirement to secure the API with WAF for REST-based APIs, complementing the HTTP API association.
- ✗
Place AWS WAF in front of Amazon CloudFront and use CloudFront as the API Gateway endpoint
Why it's wrong here
CloudFront can host a WAF web ACL, but this only protects traffic entering through the distribution; direct API Gateway invoke URLs bypass it entirely. This suits architectures where all traffic is forced through CloudFront, not one requiring WAF on the API Gateway stage.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.