REST API creation in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

REST API Endpoint Response Behavior

You have created a REST API in AWS API Gateway with a GET method integrated with a Lambda function. The Lambda function returns a JSON object with a statusCode and body. What will the API Gateway return to the client if the Lambda returns {"statusCode": 200, "body": "{\"message\": \"Hello\"}"}?

A The client receives a 502 Bad Gateway error because the Lambda response is invalid.

B The client receives a JSON response with status 200 and body {"message": "Hello"}.

C The client receives a plain text response with the string {"message": "Hello"} and status 200.

D The client receives a JSON response with status 200 and body as a string containing escaped JSON.

💡 Hint

Remember that API Gateway expects the Lambda to return a string in the body field, which is sent as-is to the client.

API Gateway treats the 'body' field as a string and sends it as the HTTP response body. Since the body is a JSON string, the client receives it as a string containing escaped JSON, not as a parsed JSON object.

❓ Configuration

intermediate

Configuring CORS for REST API

You want to enable CORS on an AWS API Gateway REST API resource to allow requests from any origin. Which configuration will correctly enable CORS?

A Add an OPTIONS method with a MOCK integration that returns headers including Access-Control-Allow-Origin: '*'.

B Add a GET method and set Access-Control-Allow-Origin: '*' in the Lambda function response headers.

C Enable CORS in the API Gateway console by checking the box 'Enable CORS' on the resource and redeploy the API.

D Add a POST method with a Lambda integration and set Access-Control-Allow-Origin: '*' in the method response.

💡 Hint

CORS requires a preflight OPTIONS request that returns specific headers.

To enable CORS, you must add an OPTIONS method that responds with the required CORS headers. This is often done with a MOCK integration returning Access-Control-Allow-Origin: '*'.

❓ Architecture

advanced

Designing a Secure REST API with AWS Services

You need to design a REST API that only allows authenticated users to access certain endpoints. Which AWS service combination provides the best security and scalability?

A Use API Gateway with resource policies to restrict IP addresses and integrate directly with EC2 instances.

B Use API Gateway with IAM roles assigned to users and integrate with Lambda functions without authentication.

C Use API Gateway with Lambda authorizer to validate JWT tokens issued by Amazon Cognito, and integrate with Lambda functions.

D Use API Gateway with no authentication and rely on Lambda functions to check user credentials.

💡 Hint

Think about managed authentication services and token validation.

Using API Gateway with a Lambda authorizer that validates JWT tokens from Amazon Cognito provides secure, scalable authentication for REST APIs.

✅ Best Practice

advanced

Optimizing REST API Performance in AWS

Which practice will most effectively reduce latency and improve performance for a global REST API deployed with AWS API Gateway and Lambda?

A Deploy API Gateway with edge-optimized endpoint and use a single Lambda function in one region.

B Enable API Gateway caching on frequently requested endpoints and deploy Lambda functions in multiple regions with latency-based routing.

C Use API Gateway without caching and rely on Lambda cold start optimization techniques only.

D Increase Lambda memory size to maximum and use a single region deployment for simplicity.

💡 Hint

Consider caching and geographic distribution to reduce latency.

API Gateway caching reduces repeated backend calls, and deploying Lambda in multiple regions with latency-based routing ensures users connect to the nearest region, reducing latency.

❓ security

expert

Preventing Unauthorized Access in REST API

You have a REST API in API Gateway integrated with Lambda. You want to ensure that only requests with a valid API key and a specific custom header 'X-Client-Id' are allowed. Which configuration enforces this requirement most securely?

A Enable API key requirement on the API Gateway method and use a Lambda authorizer to validate the 'X-Client-Id' header.

B Require API key on the method and check 'X-Client-Id' header inside the Lambda function code.

C Use resource policies to allow only requests with the API key and 'X-Client-Id' header.

D Use IAM authorization with API Gateway and pass 'X-Client-Id' as a query parameter.

💡 Hint

Think about combining API Gateway features for authentication and custom header validation.

API Gateway can require API keys natively, and Lambda authorizers can inspect headers like 'X-Client-Id' to allow or deny requests before invoking the backend.

Practice

1. What is the main purpose of creating a REST API in AWS?

easy

A. To store large amounts of data securely in the cloud.

B. To allow different applications to communicate over the internet using defined paths and actions.

C. To run virtual machines for hosting websites.

D. To create user accounts and manage permissions.

Solution

1. Step 1: Understand REST API purpose

   REST APIs enable communication between apps using simple commands over the internet.

2. Step 2: Identify AWS REST API role

   In AWS, REST APIs define resources (paths) and methods (actions) to allow this communication.

3. Final Answer:

   To allow different applications to communicate over the internet using defined paths and actions. -> Option B

4. Quick Check:

   REST API = communication interface [OK]

Hint: REST APIs connect apps via internet paths and actions [OK]

Common Mistakes:

• Confusing REST API with data storage services
• Thinking REST API runs virtual machines
• Mixing REST API with user management

2. Which AWS service is primarily used to create REST APIs?

easy

A. Amazon API Gateway

B. AWS Lambda

C. Amazon S3

D. Amazon EC2

Solution

1. Step 1: Identify AWS services for APIs

   Amazon API Gateway is designed to create, publish, and manage REST APIs.

2. Step 2: Differentiate other services

   Amazon S3 stores files, Lambda runs code, EC2 runs servers, but API Gateway manages APIs.

3. Final Answer:

   Amazon API Gateway -> Option A

4. Quick Check:

   API Gateway = REST API service [OK]

Hint: API Gateway is the AWS REST API builder [OK]

Common Mistakes:

• Choosing Lambda as the API creator
• Confusing S3 with API service
• Selecting EC2 for API management

3. Given this API Gateway setup: a resource path /books with a GET method using MOCK integration. What happens when a client sends a GET request to /books?

medium

A. The API fetches book data from a connected database.

B. The API returns an error because MOCK integration is invalid.

C. The API triggers a Lambda function to process the request.

D. The API returns a predefined mock response without calling any backend.

Solution

1. Step 1: Understand MOCK integration

   MOCK integration returns a fixed response defined in API Gateway without backend calls.

2. Step 2: Analyze GET method on /books

   Since GET uses MOCK, the client receives the mock response directly.

3. Final Answer:

   The API returns a predefined mock response without calling any backend. -> Option D

4. Quick Check:

   MOCK integration = fixed response [OK]

Hint: MOCK returns fixed response, no backend called [OK]

Common Mistakes:

• Assuming MOCK calls database or Lambda
• Thinking MOCK integration causes errors
• Confusing MOCK with real backend integration

4. You created a POST method on resource /orders in API Gateway but get a 403 Forbidden error when testing. What is the most likely cause?

medium

A. The MOCK integration is missing a response template.

B. The resource path /orders is misspelled in the client request.

C. The method does not have permission to invoke the backend service.

D. The API Gateway does not support POST methods.

Solution

1. Step 1: Understand 403 Forbidden in API Gateway

   403 usually means permission denied to invoke backend or access resource.

2. Step 2: Check method permissions

   POST method likely lacks permission to call backend service, causing 403 error.

3. Final Answer:

   The method does not have permission to invoke the backend service. -> Option C

4. Quick Check:

   403 = permission denied [OK]

Hint: 403 means permission denied to backend [OK]

Common Mistakes:

• Assuming API Gateway disallows POST
• Blaming client path spelling without checking
• Thinking MOCK integration causes 403

5. You want to create a REST API with a resource /users that supports GET and POST methods. You start with MOCK integration for both methods to test. Later, you want GET to fetch data from a Lambda function and POST to store data in DynamoDB via Lambda. What is the best approach to achieve this?

hard

A. Create the API with MOCK integration first, then update GET and POST methods to use Lambda integration with proper permissions.

B. Create separate APIs for MOCK and Lambda integrations and switch clients between them.

C. Use MOCK integration permanently because it is simpler and faster.

D. Directly connect POST method to DynamoDB without Lambda and keep GET as MOCK.

Solution

1. Step 1: Start with MOCK integration for testing

   MOCK lets you test API behavior without backend, a good first step.

2. Step 2: Update methods to Lambda integration

   Later, replace MOCK with Lambda integration for GET and POST to connect real backend logic.

3. Step 3: Ensure permissions and backend setup

   Configure Lambda permissions and DynamoDB access properly for smooth operation.

4. Final Answer:

   Create the API with MOCK integration first, then update GET and POST methods to use Lambda integration with proper permissions. -> Option A

5. Quick Check:

   Start MOCK, then switch to Lambda integration [OK]

Hint: Test with MOCK, then switch methods to Lambda integration [OK]

Common Mistakes:

• Trying to use MOCK and Lambda in separate APIs
• Keeping MOCK integration permanently
• Connecting POST directly to DynamoDB without Lambda