Content Delivery Network (CDN) Certification — Questions and Answers

Question 1: Which caching layer sits closest to the end user in a typical multi-tier CDN architecture?

Regional PoP (parent cache)
Origin server
DNS resolver cache
Edge PoP (leaf node) (Correct answer)

Correct answer: Edge PoP (leaf node)

Edge PoPs (leaf nodes) are geographically distributed closest to users and handle the initial request before escalating to parent caches.

Question 2: What happens to DNS resolution if all of a CDN domain's authoritative nameservers become unreachable simultaneously?

DNS resolution fails; clients cannot reach the CDN until at least one nameserver recovers (Correct answer)
The TLD registry serves cached records automatically
Clients fall back to the root nameservers for resolution
DNSSEC takes over and provides backup resolution

Correct answer: DNS resolution fails; clients cannot reach the CDN until at least one nameserver recovers

Without any reachable authoritative nameserver, recursive resolvers cannot obtain DNS answers and resolution fails entirely.

Question 3: What is the role of a 'developer portal' in a CDN's API gateway ecosystem?

To serve as a CDN origin server for static assets
To replicate API gateway configuration across all PoPs
To provide documentation, API key management, and quota dashboards to API consumers (Correct answer)
To run rate limit enforcement rules at the edge

Correct answer: To provide documentation, API key management, and quota dashboards to API consumers

A developer portal gives external consumers self-service access to API documentation, key generation, and usage/quota monitoring.

Question 4: A company is charged for CDN egress based on bytes transferred. Which content type typically generates the highest egress costs per user session?

HTML pages
JSON API responses
CSS stylesheets
High-definition video streams (Correct answer)

Correct answer: High-definition video streams

HD video streams consume far more bytes per session than text-based content, making them the primary driver of egress costs.

Question 5: What is the main advantage of using HTTP/3 (QUIC) over HTTP/2 for CDN-to-client delivery on lossy mobile networks?

HTTP/3 supports more simultaneous connections
HTTP/3 eliminates head-of-line blocking at the transport layer (Correct answer)
HTTP/3 reduces DNS lookup time
HTTP/3 uses stronger encryption algorithms

Correct answer: HTTP/3 eliminates head-of-line blocking at the transport layer

QUIC uses independent streams so a lost packet only blocks its own stream, unlike TCP where one loss stalls all HTTP/2 streams (head-of-line blocking).

Question 6: Which feature allows a CDN to enforce access control rules based on custom request attributes (e.g., query string values, custom headers) without modifying the origin application?

CDN Rules Engine (also called Edge Rules or Edge Logic) (Correct answer)
Anycast routing
Origin shield
Cache warming

Correct answer: CDN Rules Engine (also called Edge Rules or Edge Logic)

A CDN Rules Engine lets operators define conditional logic at the edge—such as blocking requests missing a custom API key header—without any changes to the origin application code.

Question 7: What is the purpose of real user monitoring (RUM) in a CDN context?

Collecting performance data from actual end-user browsers to measure true delivery quality (Correct answer)
Generating synthetic load test reports
Monitoring origin server health checks
Simulating traffic to test CDN capacity

Correct answer: Collecting performance data from actual end-user browsers to measure true delivery quality

RUM collects telemetry from real browsers (TTFB, FCP, page load time) to measure actual CDN delivery performance as experienced by users.

Question 8: What is the role of an Intermediate CA certificate in the TLS certificate chain presented by a CDN edge?

It provides the session ticket encryption key
It links the server's leaf certificate to the trusted Root CA, completing the chain of trust (Correct answer)
It stores the OCSP response for the leaf certificate
It encrypts the server's private key at rest

Correct answer: It links the server's leaf certificate to the trusted Root CA, completing the chain of trust

Intermediate CA certificates form the bridge between an end-entity certificate and the root CA, allowing roots to remain offline while intermediates sign end-entity certs.

Question 9: A retail site experiences slow Time to First Byte (TTFB) during peak sales. Which CDN technique most directly reduces TTFB for cacheable responses?

Image lazy loading
Edge caching with cache HIT serving (Correct answer)
HTTP/2 server push
TCP connection pooling to origin

Correct answer: Edge caching with cache HIT serving

When a CDN serves a cached HIT from an edge node close to the user, TTFB drops dramatically because no origin round-trip is needed.

Question 10: A CDN customer is evaluating costs for a static website with highly cacheable assets. Which metric should they prioritize to minimize monthly bills?

Number of CDN PoPs in contract
Cache hit ratio (origin offload rate) (Correct answer)
DNS query volume
SSL certificate renewal frequency

Correct answer: Cache hit ratio (origin offload rate)

For highly cacheable static content, maximizing the cache hit ratio directly minimizes origin egress charges and is the most cost-sensitive metric to track.

Question 11: Which CDN caching strategy is best suited for an API endpoint that returns user-specific data with a shared boilerplate section?

Edge Side Includes (ESI) to cache the shared section separately (Correct answer)
Cache only on the client browser
Bypass cache entirely for all API calls
Full-page caching with long TTL

Correct answer: Edge Side Includes (ESI) to cache the shared section separately

ESI allows the CDN to cache the static boilerplate fragment while dynamically assembling the personalized portion from origin per request.

Question 12: Which HTTP response header should a CDN operator monitor to detect when origin servers are setting excessively short cache TTLs that reduce offload efficiency?

Accept-Ranges
X-Forwarded-For
Cache-Control: max-age directive value (Correct answer)
Content-Length

Correct answer: Cache-Control: max-age directive value

The Cache-Control max-age value set by the origin determines how long the CDN caches objects; very low values cause frequent origin fetches and reduce offload ratio.

Question 13: What is the purpose of a CDN's 'Shield' or 'Mid-tier Cache' architecture?

Encrypt traffic between CDN and origin
Block DDoS at the network layer
Compress responses before delivery
Consolidate cache MISS requests to a single POP before hitting origin (Correct answer)

Correct answer: Consolidate cache MISS requests to a single POP before hitting origin

A shield POP acts as an intermediate cache layer, so only one request per unique object reaches the origin even if many edge nodes miss simultaneously.

Question 14: What is the primary purpose of using a CDN 'multi-CDN' strategy for premium video streaming?

Enables playback on devices that support only a single CDN provider
Reduces content licensing costs by distributing rights across providers
Improves resilience and global coverage by routing viewers to the best-performing CDN in real time (Correct answer)
Allows simultaneous broadcast of multiple camera angles

Correct answer: Improves resilience and global coverage by routing viewers to the best-performing CDN in real time

A multi-CDN strategy uses real-time performance data to route each viewer's stream to the CDN delivering the best quality, providing redundancy and global reach.

Question 15: What is the most effective way to measure success in dns & domain management within CDN professional practice?

Compare only with industry averages without considering context
Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives (Correct answer)
Count only the number of activities completed
Rely solely on supervisor opinion

Correct answer: Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives

Effective measurement combines multiple data sources — quantitative metrics, qualitative assessments, and stakeholder feedback — all aligned with clearly defined objectives for a comprehensive evaluation.

Question 16: Which token or credential management practice is most critical when integrating multiple CDN APIs in a multi-CDN control plane?

Hardcode API keys in CDN failover scripts for reliability
Use a secrets manager with per-CDN scoped credentials and automatic rotation (Correct answer)
Store all API keys in a single shared environment variable file
Share one API key across all CDN providers to reduce management overhead

Correct answer: Use a secrets manager with per-CDN scoped credentials and automatic rotation

A secrets manager with scoped, rotatable credentials limits blast radius if one CDN API key is compromised and enforces least-privilege access.

Question 17: A CDN operator wants to ensure that DNS queries from European users are answered by European PoPs. Which feature should be configured on the authoritative DNS?

Negative TTL reduction
AXFR replication to European secondaries
DNSSEC signing
GeoDNS (geography-based DNS routing) (Correct answer)

Correct answer: GeoDNS (geography-based DNS routing)

GeoDNS inspects the requester's IP geolocation and returns records pointing to the nearest regional PoP.

Question 18: What role does continuous improvement play in dns & domain management for CDN certified professionals?

It is optional and only necessary during certification renewal
It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation (Correct answer)
It applies only to new professionals in their first year
It focuses exclusively on cost reduction

Correct answer: It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation

Continuous improvement is fundamental to professional practice in dns & domain management, involving regular evaluation, feedback integration, and process enhancement to maintain high standards.

Question 19: In a multi-tier CDN hierarchy, what distinguishes a 'parent' cache from an 'edge' cache?

Edge caches fill cache misses from parent caches rather than the origin (Correct answer)
Parent caches only store video content
Edge caches use RAM while parent caches use disk
Parent caches serve end users directly while edge caches do not

Correct answer: Edge caches fill cache misses from parent caches rather than the origin

Parent (mid-tier) caches sit between edge nodes and the origin, absorbing cache-miss traffic so the origin receives far fewer requests.

Question 20: A push zone is used to distribute user-uploaded videos. What security practice should be enforced before files are uploaded to the CDN push zone?

Upload all files without inspection for speed
Disable HTTPS on the push zone for faster uploads
Scan and validate files for malware, correct MIME type, and size limits before pushing to CDN edge storage (Correct answer)
Allow any file type to maximize compatibility

Correct answer: Scan and validate files for malware, correct MIME type, and size limits before pushing to CDN edge storage

Files uploaded to push zones become publicly accessible at CDN edge; malware scanning and content validation must occur at ingestion to prevent distributing malicious files globally.

Question 21: What is a Distributed Denial of Service (DDoS) attack?

Software update
Flooding server with traffic (Correct answer)
Normal traffic
Data theft

Correct answer: Flooding server with traffic

A Distributed Denial of Service (DDoS) attack aims to overwhelm a target server or network with a massive flood of internet traffic. This traffic originates from multiple compromised computer systems, making it difficult to block. The goal is to make the targeted service or website unavailable to legitimate users by consuming all its resources.

Question 22: Which of the following best describes a key competency required for ddos protection & mitigation in CDN practice?

Memorization of all relevant regulations without understanding context
Reliance on a single methodology for all situations
The ability to work independently without any oversight
Strong analytical skills combined with effective communication and ethical judgment (Correct answer)

Correct answer: Strong analytical skills combined with effective communication and ethical judgment

CDN professionals working in ddos protection & mitigation need analytical skills to assess situations, communication skills to convey findings, and ethical judgment to make sound decisions.

Question 23: Which of the following correctly describes the execution environment difference between Cloudflare Workers and AWS Lambda@Edge?

Workers are limited to static responses; Lambda@Edge can make dynamic decisions
Workers require a VPC configuration while Lambda@Edge does not
Workers run in V8 Isolates with sub-millisecond cold starts; Lambda@Edge runs in full Node.js containers with higher cold-start latency (Correct answer)
Lambda@Edge runs closer to users than Workers

Correct answer: Workers run in V8 Isolates with sub-millisecond cold starts; Lambda@Edge runs in full Node.js containers with higher cold-start latency

Cloudflare Workers use lightweight V8 Isolates for near-zero cold starts, while Lambda@Edge runs in managed containers with higher initialization overhead.

Question 24: An API gateway uses GraphQL instead of REST. Which rate limiting dimension is most important to add beyond simple request count?

Response payload compression ratio
TLS cipher suite selection
Client geographic location
Query complexity or depth scoring (Correct answer)

Correct answer: Query complexity or depth scoring

GraphQL queries can vary enormously in compute cost, so complexity or depth scoring prevents cheap request counts from hiding expensive query execution.

Question 25: In the context of CDN certification, what is the most important consideration when implementing dns & domain management?

Minimizing documentation to save time
Ensuring alignment with established standards, stakeholder needs, and best practices (Correct answer)
Delegating all responsibilities to junior staff
Completing implementation as quickly as possible regardless of quality

Correct answer: Ensuring alignment with established standards, stakeholder needs, and best practices

When implementing dns & domain management, CDN professionals must ensure alignment with industry standards and stakeholder needs. Hasty implementation without proper planning often leads to compliance issues and suboptimal outcomes.

Question 26: Which strategy allows an API gateway to enforce rate limits consistently across multiple geographically distributed edge nodes?

Client-side enforcement via SDK
DNS TTL manipulation
Local in-memory counters per node
Centralized distributed cache (e.g., Redis) (Correct answer)

Correct answer: Centralized distributed cache (e.g., Redis)

A centralized distributed cache like Redis lets all edge nodes share and atomically update the same rate limit counters.

Question 27: A video platform uses adaptive bitrate (ABR) streaming. How does CDN configuration of ABR manifest files affect cost optimization?

ABR manifests should never be cached as they change per-user
Caching ABR manifests with short TTLs reduces origin polling while keeping streams current (Correct answer)
Caching ABR manifests has no effect on CDN costs
ABR manifests should be served only from origin to ensure accuracy

Correct answer: Caching ABR manifests with short TTLs reduces origin polling while keeping streams current

Short-TTL caching of ABR manifests balances manifest freshness for live streams with reduced origin request volume, lowering both latency and costs.

Question 28: Which tool is most appropriate for diagnosing which CDN POP a specific end user is being routed to?

nslookup with the local resolver to identify the returned IP (Correct answer)
ping to the CDN domain
traceroute or MTR to the CDN hostname
curl with --resolve flag to bypass DNS

Correct answer: nslookup with the local resolver to identify the returned IP

Running nslookup or dig from the user's local resolver reveals the edge IP assigned by the CDN's Anycast or GeoDNS, identifying the serving POP.

Question 29: A CDN customer's subdomain media.example.com must be decommissioned, but its CNAME still points to the CDN edge. What security risk does this create?

Increased latency due to stale CNAME resolution
DNS amplification attacks against the authoritative server
DNSSEC chain break for the parent zone
Subdomain takeover — an attacker can claim the CDN hostname and serve content under media.example.com (Correct answer)

Correct answer: Subdomain takeover — an attacker can claim the CDN hostname and serve content under media.example.com

If the CDN hostname is released and an attacker re-registers it, the dangling CNAME lets them hijack the subdomain.

Question 30: Which TLS 1.3 feature reduces connection setup latency compared to TLS 1.2?

Larger RSA key sizes
0-RTT (Zero Round Trip Time) resumption (Correct answer)
Mandatory certificate pinning
Elimination of SNI support

Correct answer: 0-RTT (Zero Round Trip Time) resumption

TLS 1.3's 0-RTT allows clients to send application data in the first message when resuming a previous session, eliminating one round trip.

Content Delivery Network (CDN) Certification

Validates knowledge of CDN architecture, security, DNS management, and performance optimization across topics including caching strategies, access control, origin configuration, and API gateway management. Suitable for network engineers and web infrastructure professionals.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds