Content Delivery Network (CDN) Certification — Questions and Answers

Question 1: A certificate has expired on a CDN edge node serving 50 PoPs. What is the most scalable remediation approach?

Request a new IP address for each affected PoP
Push the renewed certificate through the CDN's centralized certificate management API (Correct answer)
Manually upload the new certificate to each PoP via SSH
Enable HTTP fallback until the certificate is replaced

Correct answer: Push the renewed certificate through the CDN's centralized certificate management API

Centralized certificate management APIs propagate updated certificates to all PoPs simultaneously, making renewal scalable across large CDN networks.

Question 2: A CDN operator needs to prevent hotlinking — third-party sites embedding their customers' images. Which security feature is most effective?

Signed URL or Referer-based access control at the edge (Correct answer)
Geo-blocking all foreign IPs
Disabling HTTP caching for images
Enabling HTTP/2 for image delivery

Correct answer: Signed URL or Referer-based access control at the edge

Signed URLs (with expiry and token) or Referer header checking at the CDN edge blocks requests that don't originate from authorized domains.

Question 3: Which CDN feature specifically helps mitigate NTP amplification attacks?

Increasing TTL on cached NTP records
Enabling HTTP/2 for all connections
Blocking UDP traffic on port 123 at the edge or rate-limiting NTP responses (Correct answer)
Deploying DNSSEC on the CDN zone

Correct answer: Blocking UDP traffic on port 123 at the edge or rate-limiting NTP responses

NTP amplification uses UDP port 123; blocking or rate-limiting this port at CDN edge nodes prevents the amplified traffic from reaching the origin.

Question 4: What happens to an edge function's in-memory variables between two separate HTTP requests handled by the same edge node?

They persist only for the lifetime of that request; the next request starts fresh (Correct answer)
They are stored in L2 cache for 60 seconds
They persist indefinitely until the node restarts
They are synchronized across all edge nodes automatically

Correct answer: They persist only for the lifetime of that request; the next request starts fresh

Edge functions follow a request-scoped execution model, so in-memory state does not survive across separate requests.

Question 5: Which token or credential management practice is most critical when integrating multiple CDN APIs in a multi-CDN control plane?

Use a secrets manager with per-CDN scoped credentials and automatic rotation (Correct answer)
Hardcode API keys in CDN failover scripts for reliability
Share one API key across all CDN providers to reduce management overhead
Store all API keys in a single shared environment variable file

Correct answer: Use a secrets manager with per-CDN scoped credentials and automatic rotation

A secrets manager with scoped, rotatable credentials limits blast radius if one CDN API key is compromised and enforces least-privilege access.

Question 6: What is the purpose of DNSSEC's RRSIG record?

It specifies the mail server for a domain
It maps IP addresses to hostnames
It contains a cryptographic signature over a DNS record set (Correct answer)
It delegates a zone to a child nameserver

Correct answer: It contains a cryptographic signature over a DNS record set

RRSIG holds the digital signature for a resource record set, allowing resolvers to verify authenticity.

Question 7: How does enabling origin shield affect the accuracy of the origin server's access logs for geographic analytics?

Shield removes all logging
Origin sees double the requests
Origin logs only see shield node IPs, losing true end-user geographic data unless the CDN passes X-Forwarded-For headers (Correct answer)
No effect — origin sees all user IPs

Correct answer: Origin logs only see shield node IPs, losing true end-user geographic data unless the CDN passes X-Forwarded-For headers

Because the shield consolidates requests, the origin receives connections from shield IPs rather than end users; CDNs typically forward real client IPs via X-Forwarded-For for analytics.

Question 8: Why can't a CNAME record be placed at the zone apex (root domain) in standard DNS?

CNAME records do not support IPv6
The apex domain cannot be resolved by recursive resolvers
RFC 1034 prohibits CNAME coexistence with other record types such as SOA and NS at the same node (Correct answer)
CDN providers block apex CNAMEs for security reasons

Correct answer: RFC 1034 prohibits CNAME coexistence with other record types such as SOA and NS at the same node

RFC 1034 states a CNAME cannot share a node with other records; since the apex needs SOA/NS, a CNAME there is invalid.

Question 9: What is the purpose of a CAA (Certification Authority Authorization) DNS record in a CDN deployment?

It restricts which certificate authorities may issue TLS certificates for the domain (Correct answer)
It authenticates DNSSEC signatures
It maps the CDN edge IP to a hostname
It delegates DNS authority to a CDN nameserver

Correct answer: It restricts which certificate authorities may issue TLS certificates for the domain

CAA records prevent unauthorized CAs from issuing certificates for your domain, reducing TLS hijacking risk.

Question 10: A CDN customer's subdomain media.example.com must be decommissioned, but its CNAME still points to the CDN edge. What security risk does this create?

DNSSEC chain break for the parent zone
Subdomain takeover — an attacker can claim the CDN hostname and serve content under media.example.com (Correct answer)
Increased latency due to stale CNAME resolution
DNS amplification attacks against the authoritative server

Correct answer: Subdomain takeover — an attacker can claim the CDN hostname and serve content under media.example.com

If the CDN hostname is released and an attacker re-registers it, the dangling CNAME lets them hijack the subdomain.

Question 11: When a CDN professional encounters an unfamiliar challenge in api gateway & rate limiting, what is the recommended first course of action?

Research applicable standards, consult with subject matter experts, and document the approach (Correct answer)
Proceed based on personal intuition alone
Apply the solution used for the most recent similar problem without adaptation
Postpone addressing the issue indefinitely

Correct answer: Research applicable standards, consult with subject matter experts, and document the approach

Professional practice requires a methodical approach to unfamiliar challenges: research the applicable standards, consult experts when needed, and document the reasoning for the chosen approach.

Question 12: What DNS record would you add to verify domain ownership to a CDN provider during onboarding?

TXT record (Correct answer)
SOA record
MX record
SRV record

Correct answer: TXT record

CDN providers commonly require a TXT record with a provider-supplied verification token to prove domain control.

Question 13: Which certificate type provides the highest level of identity assurance for an e-commerce site served via CDN?

Domain Validated (DV)
Organization Validated (OV)
Wildcard DV
Extended Validation (EV) (Correct answer)

Correct answer: Extended Validation (EV)

EV certificates require rigorous identity verification of the organization and historically triggered a green address bar, providing the highest assurance level.

Question 14: When a CDN API gateway returns an ETag header with an API response, what rate limiting benefit does client-side caching provide?

It reduces redundant API calls by allowing conditional GET requests, preserving quota (Correct answer)
It bypasses rate limiting for authenticated users
It increases the request rate by batching multiple calls
It automatically retries failed requests within the rate limit window

Correct answer: It reduces redundant API calls by allowing conditional GET requests, preserving quota

Clients using ETags with If-None-Match can receive 304 Not Modified responses, avoiding full API calls and conserving their rate limit quota.

Question 15: Which feature allows a CDN to enforce access control rules based on custom request attributes (e.g., query string values, custom headers) without modifying the origin application?

Origin shield
Cache warming
CDN Rules Engine (also called Edge Rules or Edge Logic) (Correct answer)
Anycast routing

Correct answer: CDN Rules Engine (also called Edge Rules or Edge Logic)

A CDN Rules Engine lets operators define conditional logic at the edge—such as blocking requests missing a custom API key header—without any changes to the origin application code.

Question 16: What is the primary purpose of using a CDN 'multi-CDN' strategy for premium video streaming?

Reduces content licensing costs by distributing rights across providers
Enables playback on devices that support only a single CDN provider
Allows simultaneous broadcast of multiple camera angles
Improves resilience and global coverage by routing viewers to the best-performing CDN in real time (Correct answer)

Correct answer: Improves resilience and global coverage by routing viewers to the best-performing CDN in real time

A multi-CDN strategy uses real-time performance data to route each viewer's stream to the CDN delivering the best quality, providing redundancy and global reach.

Question 17: Which HTTP response header should a CDN operator monitor to detect when origin servers are setting excessively short cache TTLs that reduce offload efficiency?

Accept-Ranges
X-Forwarded-For
Content-Length
Cache-Control: max-age directive value (Correct answer)

Correct answer: Cache-Control: max-age directive value

The Cache-Control max-age value set by the origin determines how long the CDN caches objects; very low values cause frequent origin fetches and reduce offload ratio.

Question 18: A signed CDN URL contains the parameter `exp=1719878400`. What does this value represent?

The file expiration age in seconds
The number of allowed downloads for the URL
The Unix timestamp after which the token is no longer valid (Correct answer)
The cache TTL override in minutes

Correct answer: The Unix timestamp after which the token is no longer valid

The `exp` parameter is a Unix timestamp representing the exact point in time after which the CDN edge will reject requests using that signed URL.

Question 19: Which DNS record type is used to define the hostname and port of a CDN's streaming media service endpoint?

NAPTR
CNAME
SRV (Correct answer)
MX

Correct answer: SRV

SRV records specify both the hostname and TCP/UDP port for a specific service, enabling clients to discover service endpoints automatically.

Question 20: A CDN-delivered API endpoint intermittently returns cached error responses (e.g., 500 errors) to clients. What configuration change would prevent this?

Add Vary: Origin to response headers
Increase the CDN TTL for all responses
Configure the CDN to not cache 5xx responses (negative caching prevention) (Correct answer)
Enable HTTP/2 push for API responses

Correct answer: Configure the CDN to not cache 5xx responses (negative caching prevention)

By default some CDNs may cache error responses; explicitly configuring the CDN to bypass cache for 5xx status codes prevents error responses from being served to subsequent users.

Question 21: Which HTTP method is typically exempt from CDN caching and therefore has the most direct impact on API gateway rate limiting?

HEAD
OPTIONS
GET
POST (Correct answer)

Correct answer: POST

POST requests are not cached by CDNs because they carry request bodies and mutate state, so every POST hits the origin and the rate limiter.

Question 22: What is the role of traffic analysis in troubleshooting?

Increase errors
Reduce traffic
Identify abnormal patterns (Correct answer)
Ignore traffic

Correct answer: Identify abnormal patterns

Traffic analysis in CDN troubleshooting involves examining the flow and characteristics of data requests and responses across the network. By analyzing traffic patterns, such as sudden spikes in requests, unusual geographical sources, or atypical content access, administrators can identify potential issues like DDoS attacks, misconfigurations, or compromised accounts. This helps in diagnosing problems and implementing appropriate countermeasures.

Question 23: A company is charged for CDN egress based on bytes transferred. Which content type typically generates the highest egress costs per user session?

HTML pages
High-definition video streams (Correct answer)
JSON API responses
CSS stylesheets

Correct answer: High-definition video streams

HD video streams consume far more bytes per session than text-based content, making them the primary driver of egress costs.

Question 24: A CDN supports 'token revocation' by checking tokens against a blocklist. What is the main operational challenge of this approach?

Token blocklists cannot be stored in databases larger than 1,000 entries
Token revocation requires the origin to regenerate all active tokens simultaneously
Revoked tokens automatically reactivate after 24 hours due to CDN cache TTL
The blocklist must be replicated to all edge nodes globally with low latency, adding complexity and potential inconsistency (Correct answer)

Correct answer: The blocklist must be replicated to all edge nodes globally with low latency, adding complexity and potential inconsistency

Distributing a token blocklist to potentially hundreds of globally distributed edge PoPs in near-real-time is operationally complex and can introduce a revocation lag during propagation.

Question 25: Which edge function event hook allows you to modify an HTTP response before it is delivered to the client, including adding security headers?

TLS handshake event
fetch event on the request lifecycle before the upstream call
Origin connect event
The response transform phase within event.respondWith() after fetching from origin (Correct answer)

Correct answer: The response transform phase within event.respondWith() after fetching from origin

Platforms expose a response-phase hook (within event.respondWith()) where developers can mutate the Response object to inject security headers like CSP or HSTS.

Question 26: What is the main purpose of content distribution in a CDN?

Manage databases
Store data centrally
Deliver content from nearby servers (Correct answer)
Control user access

Correct answer: Deliver content from nearby servers

The main purpose of content distribution in a CDN is to deliver web content to users from servers that are geographically closest to them. By replicating content across a global network of edge servers, CDNs reduce the physical distance data needs to travel. This significantly lowers latency and improves the speed and reliability of content delivery, enhancing the overall user experience.

Question 27: A CDN WAF is configured in 'monitor' mode. What is the effect on malicious traffic?

Traffic is redirected to a honeypot
Traffic is blocked and logged
Traffic is rate-limited
Traffic is allowed but logged for analysis (Correct answer)

Correct answer: Traffic is allowed but logged for analysis

Monitor (or detection-only) mode logs rule matches without blocking, allowing teams to tune rules before enabling enforcement.

Question 28: What is the most effective way to measure success in cost optimization & traffic management within CDN professional practice?

Rely solely on supervisor opinion
Compare only with industry averages without considering context
Count only the number of activities completed
Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives (Correct answer)

Correct answer: Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives

Effective measurement combines multiple data sources — quantitative metrics, qualitative assessments, and stakeholder feedback — all aligned with clearly defined objectives for a comprehensive evaluation.

Question 29: How does caching improve performance?

Increase load times
Reduce load and speed delivery (Correct answer)
Decrease availability
Block users

Correct answer: Reduce load and speed delivery

Caching improves performance by storing copies of frequently accessed content on CDN edge servers, which are geographically closer to users. When a user requests content, it can be served directly from the cache, eliminating the need to fetch it from the origin server. This reduces the load on the origin server and significantly decreases content delivery times, resulting in faster page loads and a better user experience.

Question 30: What is the primary purpose of an API gateway's 'circuit breaker' pattern when integrated with a CDN?

To encrypt all traffic between edge and origin
To rate limit outbound CDN traffic
To rewrite API responses into CDN-friendly formats
To stop sending requests to a failing origin and return cached or error responses (Correct answer)

Correct answer: To stop sending requests to a failing origin and return cached or error responses

A circuit breaker detects repeated failures to an origin and temporarily stops forwarding requests, protecting the origin from further overload.

Content Delivery Network (CDN) Certification

Validates knowledge of CDN architecture, security, DNS management, and performance optimization across topics including caching strategies, access control, origin configuration, and API gateway management. Suitable for network engineers and web infrastructure professionals.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy