Security in Amazon Web Services (CISN 74A) Practice Test 2026 – Complete Guide to Master AWS Security!

An API Gateway can be secured effectively by implementing authentication and authorization protocols. This approach ensures that only authenticated users or systems can access the API and that they have the appropriate permissions to perform specific actions within the API.

Authentication validates the identity of the user or system making a request to the API, often through methods like API keys, OAuth tokens, or AWS SigV4 signing. Authorization, on the other hand, controls what authenticated users can do within the API, utilizing techniques such as IAM policies or resource-based policies in AWS. By combining these mechanisms, the API Gateway can ensure that only legitimate requests are processed, while unauthorized access is thwarted. This multi-layered security enhances the overall integrity and confidentiality of the services exposed by the API.

The other options, such as enabling open network access, would not secure the API but rather expose it to all potential threats. User monitoring and activity logs are important for auditing and operability but do not prevent unauthorized access. Limiting the API's use to private networks can add a layer of security, yet it is not comprehensive on its own as it does not address authentication and authorization, which are crucial for API security.