AWS Certified Solutions Architect CloudFront and Content Delivery 2 — Questions and Answers
Question 1: A company wants to invalidate specific files cached in CloudFront immediately after a deployment. What is the most efficient approach?
- Update the CloudFront TTL to 0 and wait for the cache to expire naturally
- Create an invalidation request specifying the paths of the objects to remove from edge caches (Correct answer)
- Delete and recreate the CloudFront distribution
- Change the S3 bucket policy to force CloudFront to re-fetch content
Correct answer: Create an invalidation request specifying the paths of the objects to remove from edge caches
Submitting a cache invalidation request with specific object paths (e.g., /images/logo.png or /*) forces CloudFront to remove those objects from all edge caches immediately.
Question 2: What is the key difference between CloudFront Signed URLs and Signed Cookies?
- Signed URLs are more secure than Signed Cookies
- Signed URLs restrict access to a single file; Signed Cookies can grant access to multiple files (Correct answer)
- Signed Cookies only work with EC2 origins, while Signed URLs work with S3
- Signed URLs require Lambda@Edge, while Signed Cookies do not
Correct answer: Signed URLs restrict access to a single file; Signed Cookies can grant access to multiple files
Signed URLs provide access to a single specific object, making them ideal for individual file downloads, while Signed Cookies can restrict access to multiple files matching a path pattern.
Question 3: A solutions architect wants to reduce load on the origin by shielding it from repeated cache-miss requests across multiple CloudFront edge locations. Which feature helps?
- CloudFront Field-Level Encryption
- CloudFront Origin Shield (Correct answer)
- CloudFront Cache Policies
- AWS Global Accelerator
Correct answer: CloudFront Origin Shield
CloudFront Origin Shield adds an additional caching layer between regional edge caches and the origin, consolidating requests to reduce origin load and improve cache hit ratios.
Question 4: Which CloudFront Price Class setting would reduce costs by limiting distribution to only North America and Europe edge locations?
- Price Class All
- Price Class 200
- Price Class 100 (Correct answer)
- Price Class 50
Correct answer: Price Class 100
Price Class 100 limits CloudFront delivery to the least expensive edge locations in North America and Europe, reducing costs by excluding higher-priced regions like Asia and South America.
Question 5: What happens when CloudFront is configured with an origin group containing a primary and secondary origin?
- CloudFront load-balances requests equally between both origins at all times
- CloudFront routes all traffic to the secondary origin only during peak hours
- CloudFront automatically fails over to the secondary origin if the primary returns specific HTTP error codes (Correct answer)
- CloudFront uses the secondary origin only for static content and the primary for dynamic content
Correct answer: CloudFront automatically fails over to the secondary origin if the primary returns specific HTTP error codes
CloudFront origin groups provide failover by routing requests to a secondary origin when the primary origin returns configurable HTTP error status codes (e.g., 500, 502, 503, 504).
Question 6: A company needs to encrypt specific sensitive fields (such as credit card numbers) in HTTP POST requests at the CloudFront edge before they reach the origin. Which feature should be used?
- CloudFront HTTPS enforcement
- Lambda@Edge request modification
- CloudFront Field-Level Encryption (Correct answer)
- AWS KMS envelope encryption at origin
Correct answer: CloudFront Field-Level Encryption
Field-Level Encryption allows CloudFront to encrypt specific data fields in HTTPS POST requests using public-key cryptography so the data remains encrypted throughout processing until decrypted at the application layer.
Question 7: What is a CloudFront Cache Policy used to define?
- The geographic regions where content is distributed
- Which HTTP headers, cookies, and query strings are included in the cache key (Correct answer)
- The maximum number of concurrent connections to the origin
- The SSL/TLS protocol version used between CloudFront and the viewer
Correct answer: Which HTTP headers, cookies, and query strings are included in the cache key
A CloudFront Cache Policy specifies which values (headers, cookies, query strings) are included in the cache key, determining how CloudFront differentiates cached objects.
AWS Certified Solutions Architect CloudFront and Content Delivery 2
A company wants to invalidate specific files cached in CloudFront immediately after a deployment.
What is the most efficient approach?