Which of the following are not access control mechanisms for AWS API Gateway? (Choose 2 options)

Answer options:

A.Resource policies
B.Lambda authorizers
C.Server-side certificates
D.VPC RouteTables
E.Usage Plans

Answer: C, D
Following are different ways of controlling access to your AWS API Gateway.
https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-controlling-access-to-apis.html
Option C is not an access control mechanism. API Gateway accepts the client-side certificates of your backend system.
https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html#configure-api
Option D is not an access control mechanism. RouteTables in VPCs are to control network traffic flow within a VPC.For more information on VPC route tables, refer to documentation here: 
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html