SAP-C02 Question 341

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  A is right By setting the authorization to AWS_IAM for the API Gateway method, only users or roles with suitable permissions can access the endpoint. Using execute-api:Invoke permission ensures that only intended resources are accessible. Enabling API callers to sign requests with AWS Signature adds an additional layer of security, ensuring that only authorized parties have access to the resource. Using AWS X-Ray for tracing and analyzing user requests provides end-to-end visibility into each request, allowing the solutions architect to analyze latency, create service maps, and identify potential issues or bottlenecks in the system. This approach helps maintain a secure, efficient, and manageable API Gateway endpoint.

• 1

  Why not C ?

• 3

  Because a Lambda custom authorizer can validate tokens or credentials but is more complex than necessary when AWS_IAM authorization is already suitable. AWS_IAM can directly control access based on IAM roles and policies, making it simpler and more secure for restricting access. The question specifies using IAM permissions for access control, making AWS_IAM a better fit, so the correct answer is A.