REST API creation in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

REST API Endpoint Response Behavior

You have created a REST API in AWS API Gateway with a GET method integrated with a Lambda function. The Lambda function returns a JSON object with a statusCode and body. What will the API Gateway return to the client if the Lambda returns {"statusCode": 200, "body": "{\"message\": \"Hello\"}"}?

A The client receives a 502 Bad Gateway error because the Lambda response is invalid.

B The client receives a JSON response with status 200 and body {"message": "Hello"}.

C The client receives a plain text response with the string {"message": "Hello"} and status 200.

D The client receives a JSON response with status 200 and body as a string containing escaped JSON.

💡 Hint

Remember that API Gateway expects the Lambda to return a string in the body field, which is sent as-is to the client.

API Gateway treats the 'body' field as a string and sends it as the HTTP response body. Since the body is a JSON string, the client receives it as a string containing escaped JSON, not as a parsed JSON object.

❓ Configuration

intermediate

Configuring CORS for REST API

You want to enable CORS on an AWS API Gateway REST API resource to allow requests from any origin. Which configuration will correctly enable CORS?

A Add an OPTIONS method with a MOCK integration that returns headers including Access-Control-Allow-Origin: '*'.

B Add a GET method and set Access-Control-Allow-Origin: '*' in the Lambda function response headers.

C Enable CORS in the API Gateway console by checking the box 'Enable CORS' on the resource and redeploy the API.

D Add a POST method with a Lambda integration and set Access-Control-Allow-Origin: '*' in the method response.

💡 Hint

CORS requires a preflight OPTIONS request that returns specific headers.

To enable CORS, you must add an OPTIONS method that responds with the required CORS headers. This is often done with a MOCK integration returning Access-Control-Allow-Origin: '*'.

❓ Architecture

advanced

Designing a Secure REST API with AWS Services

You need to design a REST API that only allows authenticated users to access certain endpoints. Which AWS service combination provides the best security and scalability?

A Use API Gateway with resource policies to restrict IP addresses and integrate directly with EC2 instances.

B Use API Gateway with IAM roles assigned to users and integrate with Lambda functions without authentication.

C Use API Gateway with Lambda authorizer to validate JWT tokens issued by Amazon Cognito, and integrate with Lambda functions.

D Use API Gateway with no authentication and rely on Lambda functions to check user credentials.

💡 Hint

Think about managed authentication services and token validation.

Using API Gateway with a Lambda authorizer that validates JWT tokens from Amazon Cognito provides secure, scalable authentication for REST APIs.

✅ Best Practice

advanced

Optimizing REST API Performance in AWS

Which practice will most effectively reduce latency and improve performance for a global REST API deployed with AWS API Gateway and Lambda?

A Deploy API Gateway with edge-optimized endpoint and use a single Lambda function in one region.

B Enable API Gateway caching on frequently requested endpoints and deploy Lambda functions in multiple regions with latency-based routing.

C Use API Gateway without caching and rely on Lambda cold start optimization techniques only.

D Increase Lambda memory size to maximum and use a single region deployment for simplicity.

💡 Hint

Consider caching and geographic distribution to reduce latency.

API Gateway caching reduces repeated backend calls, and deploying Lambda in multiple regions with latency-based routing ensures users connect to the nearest region, reducing latency.

❓ security

expert

Preventing Unauthorized Access in REST API

You have a REST API in API Gateway integrated with Lambda. You want to ensure that only requests with a valid API key and a specific custom header 'X-Client-Id' are allowed. Which configuration enforces this requirement most securely?

A Enable API key requirement on the API Gateway method and use a Lambda authorizer to validate the 'X-Client-Id' header.

B Require API key on the method and check 'X-Client-Id' header inside the Lambda function code.

C Use resource policies to allow only requests with the API key and 'X-Client-Id' header.

D Use IAM authorization with API Gateway and pass 'X-Client-Id' as a query parameter.

💡 Hint

Think about combining API Gateway features for authentication and custom header validation.

API Gateway can require API keys natively, and Lambda authorizers can inspect headers like 'X-Client-Id' to allow or deny requests before invoking the backend.