CDN Origin Shield & Pull/Push Zones Flashcards

How does enabling origin shield affect the accuracy of the origin server's access logs for geographic analytics?

Answer: Origin logs only see shield node IPs, losing true end-user geographic data unless the CDN passes X-Forwarded-For headers

Because the shield consolidates requests, the origin receives connections from shield IPs rather than end users; CDNs typically forward real client IPs via X-Forwarded-For for analytics.

What is the key operational difference between a CDN 'purge by URL' and a 'purge by cache tag/surrogate key'?

Answer: Purge by URL targets a single object; cache tag purge invalidates all objects sharing a tag in one API call

Surrogate key (cache tag) purging lets operators associate many URLs with a logical tag and invalidate all of them atomically with one request, far more efficient than URL-by-URL purges.

A push zone is used to distribute user-uploaded videos. What security practice should be enforced before files are uploaded to the CDN push zone?

Answer: Scan and validate files for malware, correct MIME type, and size limits before pushing to CDN edge storage

Files uploaded to push zones become publicly accessible at CDN edge; malware scanning and content validation must occur at ingestion to prevent distributing malicious files globally.

What does 'stale-while-revalidate' Cache-Control directive accomplish at an origin shield?

Answer: Serves the stale cached object to users immediately while asynchronously revalidating the cache in the background

Stale-while-revalidate allows the shield to immediately serve the cached (potentially stale) response while fetching a fresh copy from origin in the background, eliminating user-visible latency on revalidation.

Which CDN pull zone configuration option controls whether query string parameters differentiate cached objects?

Answer: Query string caching behavior (ignore, include, or whitelist specific parameters)

Query string caching behavior determines whether `?v=1` and `?v=2` are treated as separate cache keys or the same, allowing operators to control cache fragmentation.

An origin shield node experiences a failure. How should a well-architected CDN handle continued service delivery?

Answer: Edge nodes automatically bypass the failed shield and send cache misses directly to the origin

CDN platforms are designed to detect shield failures and fall back to direct origin fetches, ensuring availability is maintained even though origin load temporarily increases.