Security & Performance Optimization Flashcards

When configuring a CDN WAF, what is the key difference between a 'detection mode' and a 'prevention mode' ruleset?

Answer: Detection mode logs threats without blocking; prevention mode actively blocks

In detection (monitoring) mode the WAF logs rule matches but passes traffic through; in prevention (blocking) mode matched requests are dropped.

A CDN is configured to cache a page for 1 hour (max-age=3600). The origin sends a 'Cache-Control: no-store' header in a subsequent response. What should the CDN do?

Answer: Immediately purge the cached copy and not cache the new response

'no-store' instructs all caches including CDNs to neither store nor serve the response from cache; the object must be removed.

Which CDN performance feature compresses the TCP slow-start window by reusing existing TCP connections between CDN POPs and the origin?

Answer: Persistent (keep-alive) connections with origin

Persistent connections between CDN edge nodes and origin avoid the TCP slow-start penalty on every new object fetch, reducing latency.

What does 'cache key normalization' accomplish in CDN configuration?

Answer: Removes irrelevant query parameters so equivalent URLs share a single cached object

Cache key normalization strips or sorts query parameters that don't affect content, preventing redundant cache entries for the same effective resource.

A financial services company requires that customer PII never be stored on CDN edge nodes. Which CDN configuration achieves this?

Answer: Set max-age=0 and private cache-control on API responses

'Cache-Control: private, max-age=0' prevents CDN edge nodes from caching responses, ensuring PII stays only at the origin.

Which CDN security feature validates that a resource loaded on a webpage matches a known cryptographic hash, protecting against supply chain attacks?

Answer: Subresource Integrity (SRI)

SRI lets browsers verify that a CDN-hosted script or stylesheet matches its expected hash, detecting tampering or substitution.

What is the main advantage of using HTTP/3 (QUIC) over HTTP/2 for CDN-to-client delivery on lossy mobile networks?

Answer: HTTP/3 eliminates head-of-line blocking at the transport layer

QUIC uses independent streams so a lost packet only blocks its own stream, unlike TCP where one loss stalls all HTTP/2 streams (head-of-line blocking).