Content Delivery Network (CDN) Certification — Questions and Answers

Question 1: Which HTTP method is typically exempt from CDN caching and therefore has the most direct impact on API gateway rate limiting?

GET
OPTIONS
POST (Correct answer)
HEAD

Correct answer: POST

POST requests are not cached by CDNs because they carry request bodies and mutate state, so every POST hits the origin and the rate limiter.

Question 2: Which of the following correctly describes the execution environment difference between Cloudflare Workers and AWS Lambda@Edge?

Workers require a VPC configuration while Lambda@Edge does not
Workers are limited to static responses; Lambda@Edge can make dynamic decisions
Lambda@Edge runs closer to users than Workers
Workers run in V8 Isolates with sub-millisecond cold starts; Lambda@Edge runs in full Node.js containers with higher cold-start latency (Correct answer)

Correct answer: Workers run in V8 Isolates with sub-millisecond cold starts; Lambda@Edge runs in full Node.js containers with higher cold-start latency

Cloudflare Workers use lightweight V8 Isolates for near-zero cold starts, while Lambda@Edge runs in managed containers with higher initialization overhead.

Question 3: A CDN-delivered API endpoint intermittently returns cached error responses (e.g., 500 errors) to clients. What configuration change would prevent this?

Enable HTTP/2 push for API responses
Increase the CDN TTL for all responses
Configure the CDN to not cache 5xx responses (negative caching prevention) (Correct answer)
Add Vary: Origin to response headers

Correct answer: Configure the CDN to not cache 5xx responses (negative caching prevention)

By default some CDNs may cache error responses; explicitly configuring the CDN to bypass cache for 5xx status codes prevents error responses from being served to subsequent users.

Question 4: A retail site uses CDN-A for static assets and CDN-B for API acceleration. During Black Friday, CDN-B's dynamic caching is overwhelmed. Which multi-CDN design flaw does this expose?

Static and dynamic content should never be separated across CDN providers
CDN-B is not sized correctly for peak traffic volumes
The architecture lacks redundancy for the API acceleration tier; both CDNs should handle all traffic types (Correct answer)
Using two CDNs instead of one provider is inherently unreliable

Correct answer: The architecture lacks redundancy for the API acceleration tier; both CDNs should handle all traffic types

Assigning CDN responsibilities by content type creates single points of failure for each tier; both CDNs should be capable of serving all content types for true redundancy.

Question 5: What is the most effective way to measure success in dns & domain management within CDN professional practice?

Compare only with industry averages without considering context
Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives (Correct answer)
Rely solely on supervisor opinion
Count only the number of activities completed

Correct answer: Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives

Effective measurement combines multiple data sources — quantitative metrics, qualitative assessments, and stakeholder feedback — all aligned with clearly defined objectives for a comprehensive evaluation.

Question 6: Which feature allows a CDN to serve stale cached content while asynchronously revalidating it with the origin, reducing origin load?

Stale-while-revalidate (Correct answer)
Edge-side includes (ESI)
Cache warming
Prefetching

Correct answer: Stale-while-revalidate

Stale-while-revalidate serves cached responses immediately while the CDN fetches a fresh copy in the background, reducing origin hits.

Question 7: What is 'origin shield' and how does it interact with edge functions?

A CDN feature that encrypts traffic between PoPs
A DDoS firewall placed in front of the CDN
An edge function that rewrites malicious request payloads
A designated mid-tier PoP that consolidates cache misses from all edge nodes before hitting origin, reducing origin load (Correct answer)

Correct answer: A designated mid-tier PoP that consolidates cache misses from all edge nodes before hitting origin, reducing origin load

Origin shield acts as a second caching layer between edge PoPs and the origin, so cache misses from hundreds of edges are funneled through one shield node.

Question 8: Which of the following best describes a key competency required for dns & domain management in CDN practice?

Reliance on a single methodology for all situations
The ability to work independently without any oversight
Memorization of all relevant regulations without understanding context
Strong analytical skills combined with effective communication and ethical judgment (Correct answer)

Correct answer: Strong analytical skills combined with effective communication and ethical judgment

CDN professionals working in dns & domain management need analytical skills to assess situations, communication skills to convey findings, and ethical judgment to make sound decisions.

Question 9: What is the significance of the DNS 'minimum TTL' field in the SOA record for a CDN zone?

It sets the caching duration for negative (NXDOMAIN/NODATA) responses from this zone (Correct answer)
It defines the interval between zone transfers to secondary nameservers
It controls how long positive A records are cached by resolvers
It specifies the retry interval after a failed zone transfer

Correct answer: It sets the caching duration for negative (NXDOMAIN/NODATA) responses from this zone

Per RFC 2308, the SOA minimum TTL governs how long negative responses for names in that zone are cached by resolvers.

Question 10: During a CDN failover, a TTL of 30 seconds on the primary A record was set in advance. What is the maximum time a client could still reach the failed origin after the DNS update?

Indefinitely until browser cache clears
30 seconds (Correct answer)
5 minutes
48 hours

Correct answer: 30 seconds

Clients cache DNS responses for the duration of the TTL, so a 30-second TTL means at most 30 seconds before the new record is fetched.

Question 11: Which CDN API gateway feature helps detect and block abnormally large API payloads that could exhaust origin resources?

TLS certificate pinning
Request size limiting and payload inspection (Correct answer)
Cache TTL configuration
CORS policy enforcement

Correct answer: Request size limiting and payload inspection

Request size limiting rejects or truncates payloads exceeding a configured threshold, preventing large-body DoS attacks on the origin.

Question 12: What is 'always-on' DDoS mitigation, and how does it differ from 'on-demand' mitigation?

Always-on uses more PoPs than on-demand during normal traffic
Always-on mitigation requires manual activation, while on-demand is fully automated
Always-on blocks all non-whitelisted IPs, while on-demand uses rate limiting only
Always-on routes all traffic through scrubbing continuously, while on-demand activates mitigation only when an attack is detected (Correct answer)

Correct answer: Always-on routes all traffic through scrubbing continuously, while on-demand activates mitigation only when an attack is detected

Always-on mitigation provides zero-second activation time since traffic is always inspected, whereas on-demand introduces detection lag before mitigation kicks in.

Question 13: In the context of CDN DNS management, what is 'split-horizon' (split-brain) DNS?

Splitting a zone file across multiple nameservers
Returning different DNS responses to internal vs. external clients for the same hostname (Correct answer)
A BGP technique for routing around outages
Using two separate CDN vendors simultaneously

Correct answer: Returning different DNS responses to internal vs. external clients for the same hostname

Split-horizon DNS serves different records based on the requester's network, commonly used to route internal traffic off the CDN.

Question 14: Which DNS record type is used by CDNs to publish SPF policy when the CDN sends email on behalf of a customer domain?

MX
TXT (Correct answer)
SRV
CAA

Correct answer: TXT

SPF policies are stored in TXT records and list authorized mail-sending IP ranges, including those used by CDN-hosted email services.

Question 15: A CDN-delivered video stream has high rebuffering rates in Europe but not in the US. What monitoring data would most directly explain this?

Origin server CPU usage
CDN edge POP bandwidth utilization and latency metrics per region (Correct answer)
Total CDN monthly egress volume
Client device screen resolution statistics

Correct answer: CDN edge POP bandwidth utilization and latency metrics per region

Regional edge POP bandwidth saturation or high latency specific to European nodes would directly explain geographically isolated rebuffering issues.

Question 16: Which metric best indicates that a WAF rule is producing false positives in production?

High cache-hit ratio
Spike in legitimate user 403 errors after rule deployment (Correct answer)
Increase in origin CPU utilization
Decrease in DNS TTL

Correct answer: Spike in legitimate user 403 errors after rule deployment

A surge in 403 Forbidden responses for known-good users immediately after a rule change strongly indicates the rule is incorrectly blocking legitimate traffic.

Question 17: A video platform uses adaptive bitrate (ABR) streaming. How does CDN configuration of ABR manifest files affect cost optimization?

ABR manifests should never be cached as they change per-user
Caching ABR manifests with short TTLs reduces origin polling while keeping streams current (Correct answer)
Caching ABR manifests has no effect on CDN costs
ABR manifests should be served only from origin to ensure accuracy

Correct answer: Caching ABR manifests with short TTLs reduces origin polling while keeping streams current

Short-TTL caching of ABR manifests balances manifest freshness for live streams with reduced origin request volume, lowering both latency and costs.

Question 18: Which CDN configuration error most frequently causes request loops in a multi-CDN setup where CDN-A pulls from CDN-B as its origin?

CDN-A and CDN-B sharing the same cache key namespace
Mismatched SSL certificate SANs between CDN-A and CDN-B
Both CDNs using the same DNS CNAME record
CDN-B is configured to pull from CDN-A as its origin, creating a circular dependency (Correct answer)

Correct answer: CDN-B is configured to pull from CDN-A as its origin, creating a circular dependency

A circular origin-pull configuration where CDN-A pulls from CDN-B and CDN-B pulls from CDN-A results in infinite request loops and total cache miss.

Question 19: A signed CDN URL contains the parameter `exp=1719878400`. What does this value represent?

The number of allowed downloads for the URL
The cache TTL override in minutes
The file expiration age in seconds
The Unix timestamp after which the token is no longer valid (Correct answer)

Correct answer: The Unix timestamp after which the token is no longer valid

The `exp` parameter is a Unix timestamp representing the exact point in time after which the CDN edge will reject requests using that signed URL.

Question 20: When a CDN professional encounters an unfamiliar challenge in dns & domain management, what is the recommended first course of action?

Apply the solution used for the most recent similar problem without adaptation
Postpone addressing the issue indefinitely
Research applicable standards, consult with subject matter experts, and document the approach (Correct answer)
Proceed based on personal intuition alone

Correct answer: Research applicable standards, consult with subject matter experts, and document the approach

Professional practice requires a methodical approach to unfamiliar challenges: research the applicable standards, consult experts when needed, and document the reasoning for the chosen approach.

Question 21: What is the purpose of a CDN's 'Shield' or 'Mid-tier Cache' architecture?

Encrypt traffic between CDN and origin
Consolidate cache MISS requests to a single POP before hitting origin (Correct answer)
Compress responses before delivery
Block DDoS at the network layer

Correct answer: Consolidate cache MISS requests to a single POP before hitting origin

A shield POP acts as an intermediate cache layer, so only one request per unique object reaches the origin even if many edge nodes miss simultaneously.

Question 22: Which certificate type provides the highest level of identity assurance for an e-commerce site served via CDN?

Wildcard DV
Organization Validated (OV)
Domain Validated (DV)
Extended Validation (EV) (Correct answer)

Correct answer: Extended Validation (EV)

EV certificates require rigorous identity verification of the organization and historically triggered a green address bar, providing the highest assurance level.

Question 23: In the context of CDN certification, what is the most important consideration when implementing edge computing & edge functions?

Delegating all responsibilities to junior staff
Minimizing documentation to save time
Completing implementation as quickly as possible regardless of quality
Ensuring alignment with established standards, stakeholder needs, and best practices (Correct answer)

Correct answer: Ensuring alignment with established standards, stakeholder needs, and best practices

When implementing edge computing & edge functions, CDN professionals must ensure alignment with industry standards and stakeholder needs. Hasty implementation without proper planning often leads to compliance issues and suboptimal outcomes.

Question 24: When a CDN edge node receives a DNS query for content.example.com, which authoritative server is ultimately responsible for answering?

The CDN's anycast PoP
The authoritative nameserver listed in example.com's NS records (Correct answer)
The root nameserver
The ISP's recursive resolver

Correct answer: The authoritative nameserver listed in example.com's NS records

The authoritative nameserver designated by the domain's NS records holds the final, definitive answer for that zone.

Question 25: During a volumetric DDoS attack, which CDN mechanism helps absorb traffic by distributing it across many PoPs?

HTTP/2 multiplexing
Edge caching
Origin shielding
Anycast routing (Correct answer)

Correct answer: Anycast routing

Anycast routing directs incoming traffic to the nearest PoP, spreading volumetric attack load across the CDN's global network capacity.

Question 26: Which metric best measures the effectiveness of a CDN's caching configuration at reducing origin load?

Cache Hit Ratio (CHR) (Correct answer)
Time to First Byte (TTFB)
SSL handshake duration
DNS resolution time

Correct answer: Cache Hit Ratio (CHR)

Cache Hit Ratio (CHR) is the percentage of requests served from cache versus total requests; a higher CHR means fewer requests reach the origin.

Question 27: A global e-commerce platform routes 70% of US traffic to CDN-A and 30% to CDN-B. CDN-A suffers a regional outage. What is the correct failover behavior if CDN-B is configured for active-active operation?

DNS TTL must expire before any traffic shifts to CDN-B
Traffic stops until CDN-A recovers
CDN-B begins serving 30% of US traffic while 70% returns 503 errors
The traffic steering layer redirects 100% of US traffic to CDN-B automatically (Correct answer)

Correct answer: The traffic steering layer redirects 100% of US traffic to CDN-B automatically

An active-active system with automated steering detects the CDN-A outage and reroutes all affected traffic to CDN-B without operator intervention.

Question 28: What is a Distributed Denial of Service (DDoS) attack?

Flooding server with traffic (Correct answer)
Data theft
Normal traffic
Software update

Correct answer: Flooding server with traffic

A Distributed Denial of Service (DDoS) attack aims to overwhelm a target server or network with a massive flood of internet traffic. This traffic originates from multiple compromised computer systems, making it difficult to block. The goal is to make the targeted service or website unavailable to legitimate users by consuming all its resources.

Question 29: What is the purpose of 'last-resort' origin failover configuration in a multi-CDN architecture?

To route premium users directly to the origin for lower latency
To allow the origin to bypass CDN caching during low-traffic periods
To enable A/B testing by sending a subset of users around the CDN
To ensure user requests reach the origin server directly if all CDN providers simultaneously fail (Correct answer)

Correct answer: To ensure user requests reach the origin server directly if all CDN providers simultaneously fail

A last-resort origin failover path guarantees site availability even in catastrophic multi-CDN failure scenarios by allowing direct origin access.

Question 30: Which protocol is ACME (Automatic Certificate Management Environment) most commonly associated with?

Symantec Managed PKI
DigiCert Enterprise API
Let's Encrypt certificate issuance automation (Correct answer)
Microsoft Active Directory Certificate Services

Correct answer: Let's Encrypt certificate issuance automation

ACME is the protocol developed alongside Let's Encrypt to automate DV certificate issuance, renewal, and revocation.

Question 31: A CDN delivers a 2-hour VOD film. Which caching strategy is most appropriate for the video segments?

Short TTL of 30 seconds to ensure freshness
Cache only the first 10 minutes of the film
Long TTL with immutable cache headers since VOD segments never change (Correct answer)
No caching; always fetch from origin

Correct answer: Long TTL with immutable cache headers since VOD segments never change

VOD segments are static and never change, so immutable cache headers with long TTLs maximize cache efficiency and minimize origin load.

Question 32: A CDN edge node receives a 'Vary: Accept-Encoding' header from origin. What does this instruct the CDN to do?

Ignore the encoding preference of the client
Compress all responses before caching
Forward all requests to origin without caching
Cache separate versions of the resource based on the Accept-Encoding request header value (Correct answer)

Correct answer: Cache separate versions of the resource based on the Accept-Encoding request header value

The Vary header tells the CDN to store distinct cached copies for each unique value of the specified request header (e.g., gzip vs. br vs. identity).

Question 33: A CDN notices that the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA is still negotiated by some clients. What is the primary concern?

It is incompatible with HTTP/2
It requires an EV certificate
It lacks forward secrecy because RSA key exchange is used (Correct answer)
It does not support SNI

Correct answer: It lacks forward secrecy because RSA key exchange is used

RSA key exchange does not provide forward secrecy; if the server's private key is later compromised, all past recorded sessions can be decrypted.

Question 34: An API gateway sitting in front of a CDN origin needs to enforce per-client quotas. Which HTTP header should the gateway return to tell clients when their quota resets?

Retry-After
X-RateLimit-Reset (Correct answer)
X-Rate-Limit-Retry-After
X-Quota-Expiry

Correct answer: X-RateLimit-Reset

X-RateLimit-Reset is the de facto standard header conveying the Unix timestamp when the rate limit window resets.

Question 35: Which CDN traffic management feature automatically routes traffic away from a failing origin region to a healthy backup region?

Rate limiting
Cache purging
Automatic failover / origin health checks (Correct answer)
Request collapsing

Correct answer: Automatic failover / origin health checks

Origin health checks continuously probe origin endpoints and trigger automatic failover to backup origins when primary origins become unresponsive.

Question 36: What does monitoring the CDN's 'origin connection time' metric help diagnose?

End-user download speed
SSL certificate chain validation duration
Number of concurrent CDN users
Latency between the CDN edge and origin server, useful for detecting origin network or geographic placement issues (Correct answer)

Correct answer: Latency between the CDN edge and origin server, useful for detecting origin network or geographic placement issues

Origin connection time measures how long CDN edge nodes take to establish connections to the origin, identifying whether origin is geographically far from edges or experiencing network congestion.

Question 37: What is load balancing?

Centralizing traffic
Distributing traffic evenly (Correct answer)
Blocking traffic
Ignoring requests

Correct answer: Distributing traffic evenly

Load balancing is the process of distributing incoming network traffic across multiple servers or resources. Its primary purpose is to ensure that no single server becomes overwhelmed, thereby optimizing resource utilization and maximizing throughput. By distributing traffic evenly, load balancing enhances the availability, reliability, and responsiveness of applications and websites.

Question 38: Why is latency monitoring important?

Increase delays
Reduce bandwidth
Block traffic
Maintain fast delivery (Correct answer)

Correct answer: Maintain fast delivery

Latency monitoring tracks the time it takes for data to travel from the CDN server to the end-user. High latency directly translates to slower page load times and a poor user experience. By continuously monitoring latency, CDN operators can identify network bottlenecks, server issues, or routing problems that might be causing delays, allowing them to take corrective actions to maintain fast content delivery.

Question 39: What is the benefit of geographic load balancing?

Increase traffic
Limit users
Ignore server load
Reduce latency by location (Correct answer)

Correct answer: Reduce latency by location

Geographic load balancing directs user requests to the CDN edge server or data center that is geographically closest to them. By minimizing the physical distance data needs to travel, it significantly reduces network latency. This results in faster content delivery and an improved user experience, especially for a globally distributed audience accessing content from various locations.

Question 40: What is the primary purpose of CDN traffic shaping in a cost optimization context?

To encrypt all traffic between users and edge nodes
To increase the number of CDN PoPs
To replace origin servers entirely
To prioritize or throttle specific traffic types to control bandwidth costs (Correct answer)

Correct answer: To prioritize or throttle specific traffic types to control bandwidth costs

Traffic shaping lets CDN operators throttle lower-priority traffic and reserve bandwidth for high-value content, preventing unexpected egress cost overruns.

Question 41: What does a sudden spike in 5xx errors from a CDN edge while the origin server shows normal health indicate?

Client SSL handshake failures
DNS misconfiguration at the registrar
A configuration error was recently deployed to the CDN edge layer (Correct answer)
The origin is overloaded

Correct answer: A configuration error was recently deployed to the CDN edge layer

When origin is healthy but CDN returns 5xx errors, a recent edge configuration change (routing rules, caching directives, security policies) is the most likely cause.

Question 42: What is 'stale-while-revalidate' (SWR) and what problem does it solve at the edge?

A TLS certificate rotation mechanism that avoids downtime
A header that forces the browser to revalidate every request
A fallback that serves the origin response when the edge cache is full
A caching directive that serves a stale cached response immediately while refreshing the cache in the background, eliminating latency spikes on cache expiry (Correct answer)

Correct answer: A caching directive that serves a stale cached response immediately while refreshing the cache in the background, eliminating latency spikes on cache expiry

SWR decouples cache freshness from user-facing latency so users always get a fast cached hit while the edge silently updates the entry for the next request.

Question 43: A multi-CDN operator wants to test failover procedures without impacting production users. Which technique allows this?

Use a canary traffic split to route a small percentage of synthetic monitoring traffic through the failover path
Disable health checks temporarily and observe natural failover behavior
Run failover tests only during off-peak hours on the live production system
Simulate failover in a staging environment with identical CDN configurations and traffic patterns mirrored from production (Correct answer)

Correct answer: Simulate failover in a staging environment with identical CDN configurations and traffic patterns mirrored from production

A staging environment with mirrored production CDN configurations allows realistic failover testing without risking real user sessions.

Question 44: A CDN PoP contains hardware that performs SSL/TLS termination. What is the main benefit of terminating TLS at the edge rather than at the origin?

It reduces round-trip latency because the TLS handshake completes near the user (Correct answer)
It forces HTTP/1.1 on the last mile
It eliminates the need for SSL certificates on origin servers
It prevents the CDN from caching HTTPS responses

Correct answer: It reduces round-trip latency because the TLS handshake completes near the user

Terminating TLS at the nearest PoP shortens the handshake RTT, since the cryptographic exchange happens close to the end user.

Question 45: What does 'per-title encoding' optimize in video streaming delivery?

Generates a custom bitrate ladder per video title based on its complexity rather than a one-size-fits-all ladder (Correct answer)
Compresses subtitle tracks alongside video per title
Assigns dedicated CDN edge nodes per content title
Adds unique watermarks to each viewer's copy for piracy tracking

Correct answer: Generates a custom bitrate ladder per video title based on its complexity rather than a one-size-fits-all ladder

Per-title encoding analyzes each video's visual complexity and generates a content-specific bitrate ladder, achieving better quality at lower bitrates than a universal ladder.

Question 46: How does caching improve performance?

Increase load times
Reduce load and speed delivery (Correct answer)
Decrease availability
Block users

Correct answer: Reduce load and speed delivery

Caching improves performance by storing copies of frequently accessed content on CDN edge servers, which are geographically closer to users. When a user requests content, it can be served directly from the cache, eliminating the need to fetch it from the origin server. This reduces the load on the origin server and significantly decreases content delivery times, resulting in faster page loads and a better user experience.

Question 47: What is the purpose of a CDN 'token authentication' mechanism for video content?

Compresses video tokens to reduce manifest file size
Ensures only authorized users with valid signed URLs can access protected video segments (Correct answer)
Speeds up segment delivery by pre-authenticating edge nodes
Enables multi-CDN failover without re-authentication

Correct answer: Ensures only authorized users with valid signed URLs can access protected video segments

Token authentication uses cryptographically signed URLs or cookies to ensure only authenticated users can retrieve protected video content from the CDN.

Question 48: What is the primary purpose of using a CDN 'multi-CDN' strategy for premium video streaming?

Reduces content licensing costs by distributing rights across providers
Allows simultaneous broadcast of multiple camera angles
Improves resilience and global coverage by routing viewers to the best-performing CDN in real time (Correct answer)
Enables playback on devices that support only a single CDN provider

Correct answer: Improves resilience and global coverage by routing viewers to the best-performing CDN in real time

A multi-CDN strategy uses real-time performance data to route each viewer's stream to the CDN delivering the best quality, providing redundancy and global reach.

Question 49: What does the Retry-After response header communicate to an API client after a 429 response?

The maximum allowed requests per minute
How many seconds or a date until the client can retry (Correct answer)
The new API key the client should use
The remaining quota in the current window

Correct answer: How many seconds or a date until the client can retry

Retry-After tells the client either a delay in seconds or an HTTP-date after which it may safely retry the request.

Question 50: How should CDN professionals handle confidential information related to dns & domain management?

Delete all records after project completion
Follow established protocols for data protection, access control, and disclosure in accordance with applicable regulations (Correct answer)
Share freely with all colleagues for transparency
Store information without any security measures

Correct answer: Follow established protocols for data protection, access control, and disclosure in accordance with applicable regulations

Confidential information must be handled according to established protocols, regulatory requirements, and professional ethics standards, including proper access control and disclosure procedures.

Question 51: Which rate limiting algorithm uses a continuously refilling virtual container to smooth out traffic bursts?

Leaky bucket
Sliding window counter
Fixed window counter
Token bucket (Correct answer)

Correct answer: Token bucket

The token bucket algorithm refills tokens at a fixed rate and allows bursts up to the bucket capacity.

Question 52: Which Diffie-Hellman variant is recommended for forward secrecy in modern CDN TLS configurations?

RSA key encapsulation
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) (Correct answer)
Static DH (DHE with fixed parameters)
DSA-based key exchange

Correct answer: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)

ECDHE provides forward secrecy using ephemeral keys and is preferred because elliptic curve math offers strong security with smaller key sizes and better performance.

Question 53: What does 'quota' differ from 'rate limit' in an API gateway context?

Quota is enforced client-side; rate limit is enforced server-side
Quota applies per request; rate limit applies per session
Quota applies to data transfer; rate limit applies to CPU usage
Quota is a long-period allowance (daily/monthly); rate limit is a short-period cap (per second/minute) (Correct answer)

Correct answer: Quota is a long-period allowance (daily/monthly); rate limit is a short-period cap (per second/minute)

A quota defines a total usage ceiling over a longer period like a day or month, while a rate limit restricts calls within a short window like per second.

Question 54: Which DNS failover strategy routes traffic to a backup CDN origin only when health checks fail?

Anycast routing
Active-passive failover (Correct answer)
Round-robin DNS
GeoDNS balancing

Correct answer: Active-passive failover

Active-passive failover keeps a secondary endpoint idle until the primary fails a health check.

Question 55: In CDN architecture, what is a 'cache key' and why does it matter?

A hardware key for tamper-proof storage
A cryptographic key used to encrypt cached objects
The unique identifier (typically URL + selected headers) used to look up a cached object (Correct answer)
The DNS record pointing to a CDN edge server

Correct answer: The unique identifier (typically URL + selected headers) used to look up a cached object

The cache key determines cache hit/miss logic; including the wrong headers (e.g., User-Agent) can fragment the cache and reduce hit rates.

Question 56: What does HSTS (HTTP Strict Transport Security) instruct a browser to do?

Block HTTP/2 fallback to HTTP/1.1
Cache the TLS certificate locally
Pin the server's public key for future connections
Always connect to the domain over HTTPS, even if the user types HTTP (Correct answer)

Correct answer: Always connect to the domain over HTTPS, even if the user types HTTP

HSTS tells the browser to reject plain HTTP connections and always use HTTPS for the specified domain and duration.

Question 57: What DNS record type is used to map a hostname to an IPv6 address?

PTR
AAAA (Correct answer)
CNAME
A

Correct answer: AAAA

AAAA records map hostnames to 128-bit IPv6 addresses, while A records handle IPv4.

Question 58: A company wants to allow Googlebot to crawl their CDN-protected site while blocking all other bots. What is the recommended approach?

Disable WAF for all search engines
Use a robots.txt exclusion only
Use IP allowlisting for Google's published crawler IP ranges combined with user-agent verification (Correct answer)
Block all user-agents containing 'bot'

Correct answer: Use IP allowlisting for Google's published crawler IP ranges combined with user-agent verification

Verifying Googlebot requires matching its declared user-agent against Google's published IP ranges via reverse DNS lookup, since user-agent alone can be spoofed.

Question 59: A CDN operator wants to identify which content types consume the most origin bandwidth. Which report or metric should they pull?

Total CDN request count by status code
SSL handshake failure rate by cipher suite
Origin traffic breakdown by MIME type or file extension with byte transfer volumes (Correct answer)
Client device type distribution

Correct answer: Origin traffic breakdown by MIME type or file extension with byte transfer volumes

Breaking down origin bandwidth by MIME type or file extension reveals which content categories (video, images, JS) are generating the most origin fetches for cache miss optimization.

Question 60: What role does continuous improvement play in dns & domain management for CDN certified professionals?

It applies only to new professionals in their first year
It is optional and only necessary during certification renewal
It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation (Correct answer)
It focuses exclusively on cost reduction

Correct answer: It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation

Continuous improvement is fundamental to professional practice in dns & domain management, involving regular evaluation, feedback integration, and process enhancement to maintain high standards.

Question 61: What is the role of glue records in DNS, and when are they required for a CDN's nameservers?

They define the authoritative server's geographic location
They encrypt nameserver responses using DNSSEC
They alias a CDN subdomain to the origin server
They provide A records for nameservers within the same zone to break circular delegation dependencies (Correct answer)

Correct answer: They provide A records for nameservers within the same zone to break circular delegation dependencies

Glue records are A records in the parent zone for in-bailiwick nameservers, preventing a chicken-and-egg resolution loop.

Question 62: Which DNS resolution mode does a CDN's authoritative DNS use to direct mobile users to edge nodes with lower latency?

AXFR zone transfer
Reverse DNS lookup
ECS (EDNS Client Subnet) — passes client IP prefix to authoritative for geo-aware responses (Correct answer)
Recursive resolution

Correct answer: ECS (EDNS Client Subnet) — passes client IP prefix to authoritative for geo-aware responses

EDNS Client Subnet (ECS) allows the recursive resolver to share the client's IP prefix so the CDN's authoritative DNS can return geo-optimized records.

Question 63: What is the primary advantage of using a CDN's distributed network for DDoS mitigation over a single on-premise scrubbing appliance?

The CDN's aggregate bandwidth across all PoPs far exceeds what any single appliance can absorb (Correct answer)
On-premise appliances cannot inspect HTTP headers
CDNs eliminate the need for firewall rules entirely
CDNs provide faster SSL termination than on-premise hardware

Correct answer: The CDN's aggregate bandwidth across all PoPs far exceeds what any single appliance can absorb

A global CDN may have terabits of aggregate capacity spread across hundreds of PoPs, making it far better suited to absorb massive volumetric DDoS attacks than any single device.

Question 64: A sports broadcaster wants to minimize live stream latency to under 3 seconds. Which technology stack best achieves this?

Standard HLS with 10-second segments
RTMP to Flash player
Progressive download over HTTP/1.1
Low-Latency HLS (LL-HLS) with partial segments (Correct answer)

Correct answer: Low-Latency HLS (LL-HLS) with partial segments

LL-HLS uses partial segments and blocking playlist reloads to achieve sub-3-second latency while maintaining CDN scalability.

Question 65: A CDN is deploying a new PoP in a region with strict data sovereignty laws. Which approach best addresses key management compliance?

Issue a separate DV certificate daily using ACME to minimize key exposure window
Use a Hardware Security Module (HSM) local to that region to store and protect the private key (Correct answer)
Disable TLS termination at that PoP and pass traffic to a central termination point
Use a shared global wildcard certificate stored in all PoPs equally

Correct answer: Use a Hardware Security Module (HSM) local to that region to store and protect the private key

Regional HSMs keep private keys within the jurisdiction, satisfying data sovereignty requirements while still enabling local TLS termination.

Question 66: Which of the following best describes a key competency required for cost optimization & traffic management in CDN practice?

Strong analytical skills combined with effective communication and ethical judgment (Correct answer)
Reliance on a single methodology for all situations
Memorization of all relevant regulations without understanding context
The ability to work independently without any oversight

Correct answer: Strong analytical skills combined with effective communication and ethical judgment

CDN professionals working in cost optimization & traffic management need analytical skills to assess situations, communication skills to convey findings, and ethical judgment to make sound decisions.

Question 67: What role does an 'Internet Exchange Point' (IXP) play in CDN infrastructure?

It is a physical facility where CDNs and ISPs interconnect to exchange traffic directly (Correct answer)
It is a government body that regulates CDN pricing
It is a type of CDN edge server optimized for video
It is a protocol for synchronizing cache state between PoPs

Correct answer: It is a physical facility where CDNs and ISPs interconnect to exchange traffic directly

IXPs are neutral facilities enabling CDNs to peer with many ISPs under one roof, reducing latency and transit costs.

Question 68: A retail site experiences slow Time to First Byte (TTFB) during peak sales. Which CDN technique most directly reduces TTFB for cacheable responses?

Edge caching with cache HIT serving (Correct answer)
Image lazy loading
HTTP/2 server push
TCP connection pooling to origin

Correct answer: Edge caching with cache HIT serving

When a CDN serves a cached HIT from an edge node close to the user, TTFB drops dramatically because no origin round-trip is needed.

Question 69: Which TLS feature allows a CDN edge server to send the certificate status during the handshake, eliminating a separate OCSP lookup by the client?

CT Log Submission
Certificate Pinning
HPKP
OCSP Stapling (Correct answer)

Correct answer: OCSP Stapling

OCSP Stapling lets the server attach a cached OCSP response to the TLS handshake, removing the client's need to query a CA.

Question 70: A CDN WAF detects a high volume of POST requests with SQL syntax in the body targeting a login endpoint. Which WAF action provides the best balance of security without impacting legitimate users?

Challenge suspected requests with a CAPTCHA or JS challenge before blocking (Correct answer)
Log the requests and alert the security team only
Block all POST requests to the login endpoint
Redirect all login traffic to a honeypot

Correct answer: Challenge suspected requests with a CAPTCHA or JS challenge before blocking

A challenge-based response (CAPTCHA/JS challenge) verifies whether the requester is human before blocking, reducing false positives against legitimate users.

Content Delivery Network (CDN) Certification

Validates knowledge of CDN architecture, security, DNS management, and performance optimization across topics including caching strategies, access control, origin configuration, and API gateway management. Suitable for network engineers and web infrastructure professionals.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy