Quizzes · Service

API Gateway

Level 0 questions on API Gateway. Read about it first if it's new to you.

Works with: Lambda (4), IAM (2), DynamoDB (1), VPC (1)

15 questions, from a pool of 16
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1Todo.io's backend runs on Lambda. Browsers need an HTTPS address to send requests to. What should sit in front of the function?

Amazon API Gateway.Correct. API Gateway gives you a managed HTTPS endpoint and passes each request to Lambda: the classic serverless API.A public IP address on the function.Not this one. Lambda functions don't have IP addresses you can call.Put the function in a public subnet.Not this one. A subnet doesn't give a function an HTTPS endpoint.An SQS queue.Not this one. A queue holds work for later. A browser waiting for an answer needs a request and a response.

Learn it: API Gateway

Question 2A buggy client starts sending thousands of requests a second to Todo.io's API. Which API Gateway feature protects the backend?

Throttling: a rate limit that rejects excess requests before they reach the backend.Correct. Extra requests get HTTP 429 (Too Many Requests) and never reach Lambda or the database.Logging every request to CloudTrail.Not this one. CloudTrail records AWS API calls; it doesn't stop anything.A WebSocket API.Not this one. That keeps connections open; it doesn't limit how many requests arrive.A longer Lambda timeout.Not this one. That makes each request last longer, which is worse under a flood.

Learn it: API Gateway

Question 3Todo.io's API Gateway invokes its Lambda function. In Todo.io's setup, which policy says that API Gateway may invoke the function?

A resource-based policy on the function.Correct. It lives on the function and names the caller (apigateway.amazonaws.com): who may use this resource.The function's execution role.Not this one. The execution role says what the function may do, not who may call it.An SCP on the account.Not this one. SCPs only cap permissions; they never grant them.A security group on the function.Not this one. Security groups filter network traffic. Invoking a function is an AWS API call, decided by IAM.

Learn it: API Gateway · IAM policy · Lambda

Question 4When a todo changes, Todo.io wants every open browser tab to update at once, without the browser asking again and again. What fits?

An API Gateway WebSocket API; the backend pushes to each connection.Correct. A WebSocket stays open both ways, so the server can send whenever something happens.A REST API with a longer timeout.Not this one. The browser still has to ask; the server can only answer.An SQS queue the browser reads from.Not this one. Browsers don't read SQS queues, and that would still be asking repeatedly.CloudWatch Logs.Not this one. Logs are for engineers to read, not for talking to browsers.

Learn it: WebSocket (API Gateway WebSocket API)

Question 5Which routes does every API Gateway WebSocket API have built in?

$connect, $disconnect and $default.Correct. They run when a browser connects, when it disconnects, and for any message no other route matches. Each can call Lambda or an HTTP backend.GET, POST, PUT and DELETE.Not this one. Those are HTTP methods, used by REST APIs./login and /logout.Not this one. Those would be routes you design yourself.$open, $close and $message.Not this one. The names are $connect, $disconnect and $default.

Learn it: WebSocket (API Gateway WebSocket API)

Question 6Todo.io's Lambda function tries to push a message to a browser by POSTing to the WebSocket API's @connections URL, and gets AccessDenied. What fixes it?

Allow execute-api:ManageConnections in the function's execution role.Correct. Pushing to a connection is an AWS API call, so IAM must allow it like any other.Open port 443 in the function's security group.Not this one. AccessDenied is an IAM answer. A network problem would time out instead.Enable CORS on the API.Not this one. CORS is about browsers calling across websites. This call comes from Lambda.Give the browser an IAM role.Not this one. The browser is the receiver here, and app users are never IAM principals.

Learn it: WebSocket (API Gateway WebSocket API) · IAM policy

Question 7Todo.io wants an API with no servers to patch or scale. Which combination is the classic serverless pattern?

API Gateway → Lambda → DynamoDB.Correct. Every piece is managed and scales on its own; you pay for requests, not idle servers.EC2 → RDS.Not this one. Both run on servers you size, and EC2 you also patch.API Gateway → EC2 → RDS.Not this one. EC2 still means servers to manage.SQS → CloudWatch Logs.Not this one. That is a queue and a log store; neither serves an API.

Learn it: API Gateway · Lambda

Question 8Which of these does API Gateway handle for Todo.io?

The HTTPS endpoint, throttling and authorisation, before requests reach the backend.Correct. It is the front door; your code behind it does the actual work.Storing the todos.Not this one. Data lives in a database such as DynamoDB or RDS.Running the business logic.Not this one. That runs in the backend, usually Lambda.Patching the backend's servers.Not this one. With Lambda there are none; with EC2 that is still your job.

Learn it: API Gateway

Question 9Where does Todo.io's public API Gateway endpoint run, relative to its VPC?

Outside the VPC, as a managed AWS service with its own public endpoint.Correct. Like DynamoDB and SQS, it is a public AWS service. It doesn't need your subnets or a NAT gateway.Inside one of the VPC's public subnets.Not this one. API Gateway doesn't run in your subnets.Inside a private subnet, reached through a NAT gateway.Not this one. NAT is for things inside the VPC calling out, not for a public front door.On an EC2 instance that Todo.io launches.Not this one. It is fully managed; there is no instance to launch.

Learn it: API Gateway · VPC (Virtual Private Cloud)

Question 10Hundreds of browsers hold WebSocket connections open to Todo.io. How does the backend send a message to one of them?

By its connection id, which API Gateway gave that connection when it opened.Correct. The backend POSTs to @connections/{id}. Todo.io stores each user's connection ids when they connect.By the browser's IP address.Not this one. The backend never talks to browsers directly; API Gateway holds the connections.By the user's IAM ARN.Not this one. App users aren't IAM principals.By an SQS queue URL.Not this one. Queues aren't connected to browsers.

Learn it: WebSocket (API Gateway WebSocket API)

Question 11What does "API Gateway" mean?

A managed HTTPS front door that passes requests to your code.Correct. Think of it as: A receptionist who takes every visitor's request and phones the right person.Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.Not this one. That describes WebSocket (API Gateway WebSocket API).Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.

Learn it: API Gateway

Question 12Which term is this? "A managed HTTPS front door that passes requests to your code."

API GatewayCorrect. Yes. Think of it as: A receptionist who takes every visitor's request and phones the right person.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.WebSocket (API Gateway WebSocket API)Not this one. WebSocket (API Gateway WebSocket API) is: An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.

Learn it: API Gateway

Question 13Which AWS term is described by this analogy? "A receptionist who takes every visitor's request and phones the right person."

API GatewayCorrect. Yes: A managed HTTPS front door that passes requests to your code.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.WebSocket (API Gateway WebSocket API)Not this one. WebSocket (API Gateway WebSocket API) is: An API Gateway API that keeps each browser connection open, so your backend can push messages at any time. Its analogy: An open phone line instead of sending letters back and forth.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.

Learn it: API Gateway

Question 14What does "WebSocket (API Gateway WebSocket API)" mean?

An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.Correct. Think of it as: An open phone line instead of sending letters back and forth.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.

Learn it: WebSocket (API Gateway WebSocket API)

Question 15Which term is this? "An API Gateway API that keeps each browser connection open, so your backend can push messages at any time."

WebSocket (API Gateway WebSocket API)Correct. Yes. Think of it as: An open phone line instead of sending letters back and forth.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.

Learn it: WebSocket (API Gateway WebSocket API)

Question 16Which AWS term is described by this analogy? "An open phone line instead of sending letters back and forth."

WebSocket (API Gateway WebSocket API)Correct. Yes: An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.

Learn it: WebSocket (API Gateway WebSocket API)

API Gateway

Worth another look

Your weak spots

Services

Concepts