Securing a unified permitting API, the team must decide where authentication is declared on API Gateway. Which statement is correct?
Select an answer to reveal the explanation.
Short Explanation
Authentication is the building’s front-door rule for the whole deployment—one authorizer or token policy—not a different ID vendor on every hallway. Set that first, then tighten individual routes with authorization.
Full Explanation
On API Gateway, authentication is declared as a deployment-wide request policy. That policy selects gateway-native token validation or an authorizer function and controls whether anonymous clients are allowed at the deployment layer. Securing the unified permitting API starts there: one front-door identity rule for the deployment, then finer authorization decisions on individual routes.
Routes do not each independently name a different identity provider inside the route back-end block as the primary authentication model. Configuring authentication only inside an Oracle Function and never on the gateway leaves the edge open and pushes inconsistent identity checks into every back end. Authentication does not require a second gateway appliance dedicated to login redirects or IdP choreography.
Exam caveat: authentication answers “who are you” at deployment scope; authorization answers “what may you do” and is where per-route scopes and anonymous exceptions are expressed. Operational check: enable deployment-level authentication with the chosen token or authorizer mode, confirm unauthenticated calls fail where required, layer route authorization for specific permitting paths, and test both interactive and service clients against the single deployment policy before tightening /admin further.