CDN CDN Origin Shield & Pull/Push Zones 2 — Questions and Answers
Question 1: An operator uses a CDN push zone to distribute a software installer. After uploading a new version, users still receive the old file. What is the most likely cause?
- The push zone upload failed silently
- Edge nodes are serving cached copies of the old file; a purge or cache invalidation is required (Correct answer)
- The new file is too large for the CDN
- DNS has not propagated
Correct answer: Edge nodes are serving cached copies of the old file; a purge or cache invalidation is required
Push zone edge nodes cache uploaded files; replacing a file at the origin/storage does not automatically evict cached copies, so a targeted purge is required.
Question 2: Which CDN feature allows operators to set different cache TTLs at the origin shield layer versus the edge PoP layer?
- Surrogate-Control header or CDN-specific cache directives (Correct answer)
- HTTP/2 Server Push
- Vary header
- ETag negotiation
Correct answer: Surrogate-Control header or CDN-specific cache directives
Headers like Surrogate-Control (Fastly) or CDN-Cache-Control allow operators to specify longer TTLs at the shield/CDN layer independently of the browser-facing Cache-Control.
Question 3: What is the trade-off of placing origin shield in a region geographically distant from the origin server?
- Higher cache-hit ratio but increased latency for cache misses that must travel further to origin (Correct answer)
- Lower cache-hit ratio and higher bandwidth costs
- Improved DDoS resistance but reduced SSL performance
- Better compression but slower cache purges
Correct answer: Higher cache-hit ratio but increased latency for cache misses that must travel further to origin
A distant shield improves global cache consolidation but adds round-trip latency on cache misses since the shield must fetch from a far origin, increasing time-to-first-byte for uncached requests.
Question 4: A CDN pull zone is configured with a 1-hour TTL. The origin content is updated. What must the operator do to immediately serve fresh content?
- Wait for TTL expiry
- Issue a cache purge/invalidation for the affected URLs (Correct answer)
- Restart the origin server
- Increase DNS TTL
Correct answer: Issue a cache purge/invalidation for the affected URLs
A cache purge removes the stale object from CDN nodes before TTL expiry, ensuring the next request fetches and caches the updated content from origin.
Question 5: What HTTP mechanism allows an origin server to validate a cached object at the shield without transferring the full response body?
- HTTP/2 multiplexing
- Conditional requests using ETag or Last-Modified headers (304 Not Modified) (Correct answer)
- Content negotiation via Accept header
- Transfer-Encoding: chunked
Correct answer: Conditional requests using ETag or Last-Modified headers (304 Not Modified)
Conditional GET requests let the shield send an If-None-Match or If-Modified-Since header; the origin returns 304 Not Modified if unchanged, saving bandwidth on revalidation.
Question 6: Which CDN architecture pattern uses origin shield together with tiered caching across multiple PoP levels?
- Flat caching
- Hierarchical (tiered) CDN caching (Correct answer)
- Peer-to-peer CDN
- Anycast DNS only
Correct answer: Hierarchical (tiered) CDN caching
Tiered caching creates a hierarchy of cache layers (edge PoP → regional shield → origin shield) so misses escalate upward, maximizing cache efficiency before hitting the origin.
CDN CDN Origin Shield & Pull/Push Zones 2
An operator uses a CDN push zone to distribute a software installer.
After uploading a new version, users still receive the old file.
What is the most likely cause?