Content Delivery Network (CDN) Certification — Questions and Answers

Question 1: What is the most effective way to measure success in ddos protection & mitigation within CDN professional practice?

Rely solely on supervisor opinion
Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives (Correct answer)
Compare only with industry averages without considering context
Count only the number of activities completed

Correct answer: Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives

Effective measurement combines multiple data sources — quantitative metrics, qualitative assessments, and stakeholder feedback — all aligned with clearly defined objectives for a comprehensive evaluation.

Question 2: A CDN provider uses DNS-based load balancing to distribute users across PoPs. What latency metric does the DNS resolver typically use to select the nearest PoP?

BGP AS path length
TCP handshake count
RTT to the resolver's IP (Correct answer)
HTTP response time

Correct answer: RTT to the resolver's IP

CDN authoritative DNS servers measure round-trip time (RTT) from the resolver's IP to select the closest PoP.

Question 3: What tool is commonly used for CDN troubleshooting?

Email client
Word processor
Spreadsheet
Log analysis tools (Correct answer)

Correct answer: Log analysis tools

Log analysis tools are crucial for CDN troubleshooting as they allow administrators to examine detailed records of all activities and events within the CDN infrastructure. These logs contain information about requests, responses, errors, and server behavior. By analyzing these logs, operators can pinpoint the root cause of performance issues, security incidents, or delivery failures.

Question 4: What CDN cost optimization technique involves compressing text-based responses before delivering them to end users?

Protocol downgrading
Gzip or Brotli compression (Correct answer)
Image transcoding
Minification only

Correct answer: Gzip or Brotli compression

Gzip and Brotli compression reduce the byte size of text responses, directly lowering egress data transfer costs.

Question 5: What is the benefit of edge caching?

Limit user access
Increase load times
Centralize content
Reduce latency with local servers (Correct answer)

Correct answer: Reduce latency with local servers

The primary benefit of edge caching is to significantly reduce latency by storing content on servers located geographically closer to the end-users. When content is served from a local edge server, the data has a shorter distance to travel, resulting in faster loading times for websites and applications. This direct delivery from nearby servers greatly enhances the user experience by providing quicker access to content.

Question 6: What role does continuous improvement play in multi-cdn strategy & failover for CDN certified professionals?

It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation (Correct answer)
It is optional and only necessary during certification renewal
It focuses exclusively on cost reduction
It applies only to new professionals in their first year

Correct answer: It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation

Continuous improvement is fundamental to professional practice in multi-cdn strategy & failover, involving regular evaluation, feedback integration, and process enhancement to maintain high standards.

Question 7: What is the role of error rate monitoring?

Detect failures and improve (Correct answer)
Increase errors
Delay responses
Ignore failures

Correct answer: Detect failures and improve

Error rate monitoring involves tracking the frequency of errors encountered during content delivery, such as HTTP 4xx (client errors) and 5xx (server errors). A high error rate indicates problems with server availability, content integrity, or network connectivity. By promptly detecting these failures, CDN operators can investigate the root cause, implement fixes, and improve the overall reliability and stability of the service.

Question 8: What is the main risk of using extremely low DNS TTLs (e.g., 5 seconds) for multi-CDN failover?

Longer time for new CDN configurations to propagate globally
Reduced cache hit rates at CDN edge nodes
Increased DNS resolver query load and potential rate limiting at authoritative nameservers (Correct answer)
Faster failover response times

Correct answer: Increased DNS resolver query load and potential rate limiting at authoritative nameservers

Very low TTLs dramatically increase DNS query frequency, which can overwhelm authoritative nameservers and DNS resolvers, creating a new point of failure.

Question 9: What is the main advantage of using HTTP/3 (QUIC) over HTTP/2 for CDN-to-client delivery on lossy mobile networks?

HTTP/3 reduces DNS lookup time
HTTP/3 eliminates head-of-line blocking at the transport layer (Correct answer)
HTTP/3 supports more simultaneous connections
HTTP/3 uses stronger encryption algorithms

Correct answer: HTTP/3 eliminates head-of-line blocking at the transport layer

QUIC uses independent streams so a lost packet only blocks its own stream, unlike TCP where one loss stalls all HTTP/2 streams (head-of-line blocking).

Question 10: Which feature allows a CDN to enforce access control rules based on custom request attributes (e.g., query string values, custom headers) without modifying the origin application?

Origin shield
Anycast routing
Cache warming
CDN Rules Engine (also called Edge Rules or Edge Logic) (Correct answer)

Correct answer: CDN Rules Engine (also called Edge Rules or Edge Logic)

A CDN Rules Engine lets operators define conditional logic at the edge—such as blocking requests missing a custom API key header—without any changes to the origin application code.

Question 11: Which hashing algorithm is most commonly used to generate HMAC-based secure tokens in CDN implementations?

SHA-1
SHA-256 (Correct answer)
CRC32
MD5

Correct answer: SHA-256

SHA-256 is the industry-standard choice for HMAC-based CDN token signing because it provides strong collision resistance and is recommended by modern security guidelines.

Question 12: A CDN customer wants to use their own branded domain (white-label) for the CDN edge URL. Which DNS record type enables this without changing the apex domain?

NS
CNAME (Correct answer)
PTR
A

Correct answer: CNAME

A CNAME aliases a subdomain (e.g., cdn.example.com) to the CDN's edge hostname, enabling white-label delivery.

Question 13: What is 'cache shielding' (also called origin shielding) designed to accomplish?

Reduce DNS TTL propagation delays
Encrypt cached objects at rest
Prevent DDoS attacks from reaching edge nodes
Funnel all cache misses through a single upstream node to protect the origin (Correct answer)

Correct answer: Funnel all cache misses through a single upstream node to protect the origin

Origin shielding collapses cache misses from many edge nodes into a single shield PoP, drastically reducing origin load.

Question 14: A CDN operator wants to ensure API responses with sensitive user data are never cached. Which Cache-Control combination is most appropriate?

no-cache, no-store, private (Correct answer)
no-cache, s-maxage=0
max-age=0, must-revalidate
private, max-age=60

Correct answer: no-cache, no-store, private

'no-cache, no-store, private' prevents both storage and serving of sensitive responses at any cache layer.

Question 15: What is 'token escalation' in the context of CDN security?

Automatically renewing expired tokens without user interaction
The process of increasing token expiry time during high-traffic events
Upgrading a CDN plan to unlock token-based authentication features
An attack where a low-privilege token is manipulated to gain access to restricted content (Correct answer)

Correct answer: An attack where a low-privilege token is manipulated to gain access to restricted content

Token escalation is a security vulnerability where an attacker modifies token parameters (e.g., changing path restrictions) to access content beyond what was originally authorized.

Question 16: A CDN customer is evaluating costs for a static website with highly cacheable assets. Which metric should they prioritize to minimize monthly bills?

Number of CDN PoPs in contract
SSL certificate renewal frequency
Cache hit ratio (origin offload rate) (Correct answer)
DNS query volume

Correct answer: Cache hit ratio (origin offload rate)

For highly cacheable static content, maximizing the cache hit ratio directly minimizes origin egress charges and is the most cost-sensitive metric to track.

Question 17: In MPEG-DASH, what does the 'MPD' file contain?

Master playlist with encryption keys
Media Presentation Description with all available representations and segment URLs (Correct answer)
Real-time viewer analytics data
CDN node health status

Correct answer: Media Presentation Description with all available representations and segment URLs

The MPD (Media Presentation Description) is DASH's manifest file that describes all available quality representations, segment templates, and timing information.

Question 18: Which leaky bucket characteristic differentiates it from the token bucket algorithm?

Leaky bucket enforces a constant output rate; token bucket permits bursts up to capacity (Correct answer)
Leaky bucket uses timestamps; token bucket uses counters
Leaky bucket permits bursts; token bucket enforces a constant rate
Leaky bucket works at Layer 7; token bucket works at Layer 4

Correct answer: Leaky bucket enforces a constant output rate; token bucket permits bursts up to capacity

The leaky bucket processes requests at a fixed constant rate regardless of input bursts, while the token bucket allows short bursts up to the bucket size.

Question 19: What is a 'wildcard token' in CDN access control?

A signed token where the path parameter uses a prefix or wildcard pattern to cover multiple resources (Correct answer)
A master API key that bypasses all CDN security rules
A token type that works across different CDN vendors without modification
A token that can be used an unlimited number of times regardless of expiry

Correct answer: A signed token where the path parameter uses a prefix or wildcard pattern to cover multiple resources

A wildcard token uses a path prefix (e.g., `/videos/show-1/*`) in the signature so one token grants access to all segments under that path without signing each URL individually.

Question 20: How should CDN professionals handle confidential information related to cost optimization & traffic management?

Follow established protocols for data protection, access control, and disclosure in accordance with applicable regulations (Correct answer)
Store information without any security measures
Share freely with all colleagues for transparency
Delete all records after project completion

Correct answer: Follow established protocols for data protection, access control, and disclosure in accordance with applicable regulations

Confidential information must be handled according to established protocols, regulatory requirements, and professional ethics standards, including proper access control and disclosure procedures.

Question 21: What does a CDN's Bot Management system use to distinguish legitimate users from automated scrapers?

DNS TTL analysis
Behavioral fingerprinting and challenge-response (Correct answer)
HTTP keep-alive timeouts
IP geolocation only

Correct answer: Behavioral fingerprinting and challenge-response

Bot management combines behavioral signals (mouse movement, request cadence) with challenges like CAPTCHAs or JS challenges to identify bots.

Question 22: What is the purpose of a CAA (Certification Authority Authorization) DNS record in a CDN deployment?

It restricts which certificate authorities may issue TLS certificates for the domain (Correct answer)
It maps the CDN edge IP to a hostname
It authenticates DNSSEC signatures
It delegates DNS authority to a CDN nameserver

Correct answer: It restricts which certificate authorities may issue TLS certificates for the domain

CAA records prevent unauthorized CAs from issuing certificates for your domain, reducing TLS hijacking risk.

Question 23: A CDN WAF is configured in 'monitor' mode. What is the effect on malicious traffic?

Traffic is rate-limited
Traffic is allowed but logged for analysis (Correct answer)
Traffic is redirected to a honeypot
Traffic is blocked and logged

Correct answer: Traffic is allowed but logged for analysis

Monitor (or detection-only) mode logs rule matches without blocking, allowing teams to tune rules before enabling enforcement.

Question 24: What is 'cache warming' in the context of CDN operations?

Pre-populating edge caches with content before user requests arrive (Correct answer)
Gradually increasing TTL values over time
Enabling keep-alive connections on cache servers
Increasing edge server temperature thresholds

Correct answer: Pre-populating edge caches with content before user requests arrive

Cache warming proactively pushes content to edge nodes to avoid cold-start latency spikes when traffic begins.

Question 25: A CDN is configured with a 1-hour TTL for static assets, but marketing needs instant cache invalidation capability. Which approach adds that capability without changing TTL?

Implement cache versioning via URL fingerprinting (e.g., file.abc123.css) (Correct answer)
Reduce TTL to 1 second globally
Disable caching for all static assets
Use Vary: User-Agent headers

Correct answer: Implement cache versioning via URL fingerprinting (e.g., file.abc123.css)

URL fingerprinting embeds a content hash in the filename, making updated files unique URLs that bypass existing cache entries without needing purge operations.

Question 26: What does the 's-maxage' directive in a Cache-Control header specifically control?

The staleness window for service workers
How long stale content can be served while revalidating
Maximum age for shared caches such as CDN edge nodes (Correct answer)
Maximum age for browser caches only

Correct answer: Maximum age for shared caches such as CDN edge nodes

's-maxage' overrides 'max-age' specifically for shared/proxy caches, allowing different TTLs for CDN vs. browser.

Question 27: A financial services company requires that customer PII never be stored on CDN edge nodes. Which CDN configuration achieves this?

Enable Brotli compression on edge nodes
Enable prefetching for authenticated routes
Set max-age=0 and private cache-control on API responses (Correct answer)
Configure HTTP/3 for all API endpoints

Correct answer: Set max-age=0 and private cache-control on API responses

'Cache-Control: private, max-age=0' prevents CDN edge nodes from caching responses, ensuring PII stays only at the origin.

Question 28: What is the significance of the DNS 'minimum TTL' field in the SOA record for a CDN zone?

It defines the interval between zone transfers to secondary nameservers
It sets the caching duration for negative (NXDOMAIN/NODATA) responses from this zone (Correct answer)
It specifies the retry interval after a failed zone transfer
It controls how long positive A records are cached by resolvers

Correct answer: It sets the caching duration for negative (NXDOMAIN/NODATA) responses from this zone

Per RFC 2308, the SOA minimum TTL governs how long negative responses for names in that zone are cached by resolvers.

Question 29: A CDN operator needs to inspect encrypted HTTPS traffic for WAF purposes. Which technique makes this possible?

HSTS preloading
Certificate Transparency logging
DNSSEC validation
TLS termination at the edge (Correct answer)

Correct answer: TLS termination at the edge

TLS termination at the CDN edge decrypts traffic so the WAF can inspect it before re-encrypting and forwarding to the origin.

Question 30: Which CDN access control method involves configuring an allowlist of trusted IP ranges (e.g., corporate office CIDRs) at the edge?

Token authentication
Mutual TLS (mTLS)
IP-based ACL (Access Control List) (Correct answer)
Referrer whitelisting

Correct answer: IP-based ACL (Access Control List)

IP-based ACLs configure CDN edge nodes to allow or deny requests based on the client's source IP address or CIDR range, commonly used to restrict access to internal tools or B2B APIs.

Question 31: How should CDN professionals handle confidential information related to api gateway & rate limiting?

Share freely with all colleagues for transparency
Delete all records after project completion
Follow established protocols for data protection, access control, and disclosure in accordance with applicable regulations (Correct answer)
Store information without any security measures

Correct answer: Follow established protocols for data protection, access control, and disclosure in accordance with applicable regulations

Confidential information must be handled according to established protocols, regulatory requirements, and professional ethics standards, including proper access control and disclosure procedures.

Question 32: A multi-CDN operator wants to test failover procedures without impacting production users. Which technique allows this?

Run failover tests only during off-peak hours on the live production system
Use a canary traffic split to route a small percentage of synthetic monitoring traffic through the failover path
Disable health checks temporarily and observe natural failover behavior
Simulate failover in a staging environment with identical CDN configurations and traffic patterns mirrored from production (Correct answer)

Correct answer: Simulate failover in a staging environment with identical CDN configurations and traffic patterns mirrored from production

A staging environment with mirrored production CDN configurations allows realistic failover testing without risking real user sessions.

Question 33: Which TLS feature allows a CDN edge server to send the certificate status during the handshake, eliminating a separate OCSP lookup by the client?

HPKP
CT Log Submission
Certificate Pinning
OCSP Stapling (Correct answer)

Correct answer: OCSP Stapling

OCSP Stapling lets the server attach a cached OCSP response to the TLS handshake, removing the client's need to query a CA.

Question 34: In an API gateway context, what is 'request throttling' as opposed to 'rate limiting'?

They are identical concepts with different naming conventions
Throttling applies to data size; rate limiting applies to request frequency
Throttling slows down processing speed; rate limiting caps request count (Correct answer)
Throttling blocks requests permanently; rate limiting is temporary

Correct answer: Throttling slows down processing speed; rate limiting caps request count

Throttling reduces the speed at which requests are processed, while rate limiting enforces a maximum number of requests in a time window.

Question 35: Which CDN performance feature compresses the TCP slow-start window by reusing existing TCP connections between CDN POPs and the origin?

Connection multiplexing via HTTP/2
Persistent (keep-alive) connections with origin (Correct answer)
Anycast routing
SYN cookie protection

Correct answer: Persistent (keep-alive) connections with origin

Persistent connections between CDN edge nodes and origin avoid the TCP slow-start penalty on every new object fetch, reducing latency.

Question 36: An edge function returns a subrequest to the origin. How is this typically different from the original client request?

It is an internal request made by the edge worker to fetch data or assets needed to construct the response (Correct answer)
It is sent to a random origin server without load balancing
It always uses HTTP/1.1 regardless of the client protocol
It bypasses TLS encryption for performance

Correct answer: It is an internal request made by the edge worker to fetch data or assets needed to construct the response

A subrequest is a programmatic fetch initiated by the edge function to retrieve upstream data while the original client connection remains open.

Question 37: What is DNS anycast and why do CDNs use it?

A DNS record type for load balancing
A single server responds to all DNS queries globally
Multiple servers share the same IP; BGP routes users to the topologically nearest one (Correct answer)
A protocol for encrypting DNS traffic in transit

Correct answer: Multiple servers share the same IP; BGP routes users to the topologically nearest one

Anycast assigns identical IPs to multiple PoPs; BGP ensures each user's query reaches the geographically or topologically closest PoP.

Question 38: What is the main purpose of content distribution in a CDN?

Control user access
Store data centrally
Deliver content from nearby servers (Correct answer)
Manage databases

Correct answer: Deliver content from nearby servers

The main purpose of content distribution in a CDN is to deliver web content to users from servers that are geographically closest to them. By replicating content across a global network of edge servers, CDNs reduce the physical distance data needs to travel. This significantly lowers latency and improves the speed and reliability of content delivery, enhancing the overall user experience.

Question 39: When a CDN performs SSL bridging (re-encryption) to the origin, what is the key security requirement?

The CDN must use TLS 1.0 for backward compatibility
The origin must use a self-signed certificate
The origin connection must use the same session ticket as the client
The CDN must validate the origin's certificate to prevent MITM between edge and origin (Correct answer)

Correct answer: The CDN must validate the origin's certificate to prevent MITM between edge and origin

Without validating the origin's certificate, the CDN-to-origin connection is vulnerable to man-in-the-middle attacks even though the client-to-CDN leg is secure.

Question 40: What is the function of Certificate Transparency (CT) logs in the context of CDN certificate management?

They provide a public, auditable record of all issued certificates (Correct answer)
They store encrypted copies of private keys
They automatically revoke misissued certificates
They cache CRL responses for CDN edge nodes

Correct answer: They provide a public, auditable record of all issued certificates

CT logs are append-only public ledgers that record every certificate issued by a CA, allowing domain owners and browsers to detect unauthorized certificates.

Question 41: What is a 'reflection amplification' DDoS attack?

An attack that mirrors traffic through multiple CDN PoPs
An attack that spoofs the victim's IP to trigger large responses from third-party servers (Correct answer)
An attack using mirrored botnets in two geographic regions
An attack that reflects HTTP headers back to confuse origin logic

Correct answer: An attack that spoofs the victim's IP to trigger large responses from third-party servers

Reflection amplification attacks spoof the victim's source IP to send small requests to open resolvers, which then flood the victim with large responses.

Question 42: A CDN edge node receives a request for a resource with 'Cache-Control: no-store'. What must the CDN do?

Cache the resource for 1 second only
Store the resource in memory only, not on disk
Not store any part of the request or response (Correct answer)
Cache the resource but never serve it from cache

Correct answer: Not store any part of the request or response

'no-store' is the strictest directive, instructing the CDN to never persist any part of the transaction.

Question 43: A CDN provider offers tiered API plans. Which rate limiting key granularity best supports per-plan enforcement?

API key or subscription tier identifier (Correct answer)
Source IP address
Geographic region
User-Agent string

Correct answer: API key or subscription tier identifier

Using the API key or subscription tier as the rate limit key allows distinct quotas to be applied per plan regardless of client IP.

Question 44: How should CDN professionals handle confidential information related to dns & domain management?

Delete all records after project completion
Share freely with all colleagues for transparency
Store information without any security measures
Follow established protocols for data protection, access control, and disclosure in accordance with applicable regulations (Correct answer)

Correct answer: Follow established protocols for data protection, access control, and disclosure in accordance with applicable regulations

Confidential information must be handled according to established protocols, regulatory requirements, and professional ethics standards, including proper access control and disclosure procedures.

Question 45: What role does continuous improvement play in ssl/tls & certificate management for CDN certified professionals?

It focuses exclusively on cost reduction
It is optional and only necessary during certification renewal
It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation (Correct answer)
It applies only to new professionals in their first year

Correct answer: It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation

Continuous improvement is fundamental to professional practice in ssl/tls & certificate management, involving regular evaluation, feedback integration, and process enhancement to maintain high standards.

Question 46: Which tool is most appropriate for diagnosing which CDN POP a specific end user is being routed to?

curl with --resolve flag to bypass DNS
traceroute or MTR to the CDN hostname
nslookup with the local resolver to identify the returned IP (Correct answer)
ping to the CDN domain

Correct answer: nslookup with the local resolver to identify the returned IP

Running nslookup or dig from the user's local resolver reveals the edge IP assigned by the CDN's Anycast or GeoDNS, identifying the serving POP.

Question 47: What are edge servers in a CDN?

User devices
Firewall servers
Central data centers
Servers near users (Correct answer)

Correct answer: Servers near users

Edge servers in a CDN are strategically located servers positioned at the 'edge' of the network, meaning they are geographically closer to the end-users. These servers cache copies of content, allowing them to deliver data with minimal delay. By reducing the physical distance data needs to travel, edge servers significantly improve content loading times and overall website performance.

Question 48: Which header is commonly inspected by CDN WAF rules to detect cross-site request forgery (CSRF) attempts?

Cache-Control
Accept-Encoding
X-Forwarded-For
Origin and Referer headers (Correct answer)

Correct answer: Origin and Referer headers

CSRF validation checks the Origin and Referer headers to ensure requests originate from the expected domain rather than a malicious third-party site.

Question 49: Which CDN troubleshooting technique involves sending the same request from multiple geographically distributed vantage points simultaneously?

Blue-green traffic splitting
Synthetic monitoring with global probes (Correct answer)
A/B testing
Canary deployment analysis

Correct answer: Synthetic monitoring with global probes

Synthetic monitoring with globally distributed probes sends identical requests from multiple locations to identify regional performance disparities or routing issues.

Question 50: In the context of CDN certification, what is the most important consideration when implementing dns & domain management?

Completing implementation as quickly as possible regardless of quality
Ensuring alignment with established standards, stakeholder needs, and best practices (Correct answer)
Delegating all responsibilities to junior staff
Minimizing documentation to save time

Correct answer: Ensuring alignment with established standards, stakeholder needs, and best practices

When implementing dns & domain management, CDN professionals must ensure alignment with industry standards and stakeholder needs. Hasty implementation without proper planning often leads to compliance issues and suboptimal outcomes.

Question 51: Which CDN component is responsible for translating a user's hostname into the IP address of the optimal edge server?

Global Traffic Manager (GTM) / DNS-based routing (Correct answer)
Origin shield
Load balancer
Reverse proxy

Correct answer: Global Traffic Manager (GTM) / DNS-based routing

A Global Traffic Manager uses DNS responses to steer clients to the best-performing edge node at request time.

Question 52: What is the significance of monitoring the CDN's TLS handshake time separately from TTFB?

Monitoring TLS separately has no diagnostic value
TLS handshake time is always negligible for CDN deployments
TLS metrics only matter for non-CDN traffic
High TLS handshake time indicates edge proximity issues or misconfigured TLS session resumption (Correct answer)

Correct answer: High TLS handshake time indicates edge proximity issues or misconfigured TLS session resumption

TLS handshake time measures connection establishment overhead; if high, it may indicate users are connecting to distant edge nodes or TLS session tickets/resumption is not working.

Question 53: What is 'always-on' DDoS mitigation, and how does it differ from 'on-demand' mitigation?

Always-on uses more PoPs than on-demand during normal traffic
Always-on routes all traffic through scrubbing continuously, while on-demand activates mitigation only when an attack is detected (Correct answer)
Always-on mitigation requires manual activation, while on-demand is fully automated
Always-on blocks all non-whitelisted IPs, while on-demand uses rate limiting only

Correct answer: Always-on routes all traffic through scrubbing continuously, while on-demand activates mitigation only when an attack is detected

Always-on mitigation provides zero-second activation time since traffic is always inspected, whereas on-demand introduces detection lag before mitigation kicks in.

Question 54: A CDN reports a high 'rebuffering ratio' for video streams. Which metric most directly indicates the severity of this problem?

Cache hit ratio for manifests
Percentage of total playback time spent buffering (Correct answer)
Average segment size in kilobytes
Total number of unique viewers

Correct answer: Percentage of total playback time spent buffering

The rebuffering ratio — buffering time divided by total playback time — directly measures how often viewers experience stalls relative to watch time.

Question 55: When a CDN API gateway returns an ETag header with an API response, what rate limiting benefit does client-side caching provide?

It reduces redundant API calls by allowing conditional GET requests, preserving quota (Correct answer)
It increases the request rate by batching multiple calls
It automatically retries failed requests within the rate limit window
It bypasses rate limiting for authenticated users

Correct answer: It reduces redundant API calls by allowing conditional GET requests, preserving quota

Clients using ETags with If-None-Match can receive 304 Not Modified responses, avoiding full API calls and conserving their rate limit quota.

Question 56: A company uses two CDNs and detects that CDN-A has a 40% cache hit rate while CDN-B has an 85% cache hit rate for the same content. What is the most likely root cause of the disparity?

CDN-A has fewer PoPs than CDN-B
CDN-B uses a superior eviction algorithm
CDN-A's TTL settings are configured too low (Correct answer)
CDN-A receives less traffic and its cache warms more slowly

Correct answer: CDN-A's TTL settings are configured too low

Excessively low TTL values cause content to expire quickly and force frequent origin fetches, dramatically reducing cache hit rates.

Question 57: A multi-CDN operator needs to ensure consistent cache purge behavior across all providers when content is updated. Which approach is most reliable?

Use different versioned URLs per CDN to avoid purge complexity
Rely on each CDN's default purge schedule
Set very short TTLs so content naturally expires quickly across all CDNs
Use a centralized purge API orchestration layer that calls each CDN provider's purge endpoint simultaneously (Correct answer)

Correct answer: Use a centralized purge API orchestration layer that calls each CDN provider's purge endpoint simultaneously

A centralized purge orchestration layer ensures that invalidation requests are sent to all CDN providers atomically when content changes.

Question 58: Which DNS failover strategy routes traffic to a backup CDN origin only when health checks fail?

Active-passive failover (Correct answer)
GeoDNS balancing
Round-robin DNS
Anycast routing

Correct answer: Active-passive failover

Active-passive failover keeps a secondary endpoint idle until the primary fails a health check.

Question 59: Which metric best indicates that a WAF rule is producing false positives in production?

Increase in origin CPU utilization
Spike in legitimate user 403 errors after rule deployment (Correct answer)
High cache-hit ratio
Decrease in DNS TTL

Correct answer: Spike in legitimate user 403 errors after rule deployment

A surge in 403 Forbidden responses for known-good users immediately after a rule change strongly indicates the rule is incorrectly blocking legitimate traffic.

Question 60: What is the significance of 'PoP diversity' when designing CDN redundancy?

Diversity means each PoP must run a different operating system
Spreading PoPs across different ISPs and buildings ensures no single outage eliminates all local coverage (Correct answer)
PoP diversity only matters for video streaming workloads
Having PoPs in many countries ensures compliance with local data laws only

Correct answer: Spreading PoPs across different ISPs and buildings ensures no single outage eliminates all local coverage

PoP diversity across carriers and facilities means a fiber cut, power failure, or ISP outage at one PoP doesn't remove CDN coverage for a region.

Question 61: Which technique allows a CDN to serve personalized content while still leveraging edge caching for the page shell?

Full-page dynamic rendering at origin
Disabling caching for authenticated users
Using cookies as the only cache key variant
Fragment caching — cache the static shell, personalize only via client-side JavaScript or ESI fragments (Correct answer)

Correct answer: Fragment caching — cache the static shell, personalize only via client-side JavaScript or ESI fragments

Fragment caching separates the cacheable page shell from personalized components fetched client-side or assembled via ESI at the edge.

Question 62: What is the primary risk of setting excessively long TTLs (e.g., 1 year) for HTML pages on a CDN?

Increased origin server load
Stale content being served after site updates (Correct answer)
Slower TTFB for first-time visitors
Higher storage costs at edge nodes

Correct answer: Stale content being served after site updates

Long TTLs mean updated HTML may not reach users until caches expire, requiring manual purges for timely updates.

Question 63: Which component in a CDN stack typically handles real-time log streaming and analytics aggregation across all edge nodes?

Anycast router
Log aggregation pipeline (e.g., Kafka + ClickHouse) (Correct answer)
Edge-side scripting runtime
Origin shield

Correct answer: Log aggregation pipeline (e.g., Kafka + ClickHouse)

High-volume edge logs are streamed via message queues and stored in columnar databases to support real-time analytics dashboards.

Question 64: What is negative caching in DNS, and how does it affect CDN traffic routing after a configuration error?

Negative caching blocks malicious DNS queries at the resolver
Recursive resolvers refuse to cache responses from CDN nameservers
NXDOMAIN/NODATA responses are cached for the SOA negative TTL, delaying recovery after fixing the error (Correct answer)
It caches failed TCP connections to CDN edge nodes

Correct answer: NXDOMAIN/NODATA responses are cached for the SOA negative TTL, delaying recovery after fixing the error

When DNS returns NXDOMAIN or NODATA, resolvers cache that negative result for the SOA's minimum TTL, so even after fixing the record, clients may be denied temporarily.

Question 65: Which DNS record type is used to define the hostname and port of a CDN's streaming media service endpoint?

SRV (Correct answer)
NAPTR
MX
CNAME

Correct answer: SRV

SRV records specify both the hostname and TCP/UDP port for a specific service, enabling clients to discover service endpoints automatically.

Question 66: What is the role of an Intermediate CA certificate in the TLS certificate chain presented by a CDN edge?

It provides the session ticket encryption key
It encrypts the server's private key at rest
It stores the OCSP response for the leaf certificate
It links the server's leaf certificate to the trusted Root CA, completing the chain of trust (Correct answer)

Correct answer: It links the server's leaf certificate to the trusted Root CA, completing the chain of trust

Intermediate CA certificates form the bridge between an end-entity certificate and the root CA, allowing roots to remain offline while intermediates sign end-entity certs.

Question 67: What is the function of the DNS SOA (Start of Authority) record's 'Refresh' field?

How often secondary nameservers check for zone updates (Correct answer)
How long a failed zone transfer is retried
The minimum TTL for negative responses
Time before a zone is considered expired

Correct answer: How often secondary nameservers check for zone updates

The Refresh field tells secondary nameservers how frequently to poll the primary for zone changes.

Question 68: When a CDN professional encounters an unfamiliar challenge in dns & domain management, what is the recommended first course of action?

Research applicable standards, consult with subject matter experts, and document the approach (Correct answer)
Proceed based on personal intuition alone
Postpone addressing the issue indefinitely
Apply the solution used for the most recent similar problem without adaptation

Correct answer: Research applicable standards, consult with subject matter experts, and document the approach

Professional practice requires a methodical approach to unfamiliar challenges: research the applicable standards, consult experts when needed, and document the reasoning for the chosen approach.

Question 69: A CDN-delivered API endpoint intermittently returns cached error responses (e.g., 500 errors) to clients. What configuration change would prevent this?

Enable HTTP/2 push for API responses
Add Vary: Origin to response headers
Configure the CDN to not cache 5xx responses (negative caching prevention) (Correct answer)
Increase the CDN TTL for all responses

Correct answer: Configure the CDN to not cache 5xx responses (negative caching prevention)

By default some CDNs may cache error responses; explicitly configuring the CDN to bypass cache for 5xx status codes prevents error responses from being served to subsequent users.

Question 70: Why is alerting important in monitoring?

Notify admins promptly (Correct answer)
Ignore notifications
Increase downtime
Disable monitoring

Correct answer: Notify admins promptly

Alerting is a critical component of CDN monitoring, designed to automatically notify administrators when predefined thresholds are breached or specific events occur. This prompt notification allows operations teams to quickly become aware of potential issues, such as high error rates, server failures, or unusual traffic patterns. Timely alerts enable rapid response and resolution, minimizing downtime and impact on users.

Content Delivery Network (CDN) Certification

Validates knowledge of CDN architecture, security, DNS management, and performance optimization across topics including caching strategies, access control, origin configuration, and API gateway management. Suitable for network engineers and web infrastructure professionals.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds