Security & Performance Optimization Flashcards

An attacker sends millions of small DNS queries to a CDN's authoritative nameservers to exhaust UDP processing capacity. Which mitigation is most appropriate?

Answer: Deploy anycast DNS with rate limiting and response rate limiting (RRL)

Anycast spreads the attack across multiple nodes while DNS Response Rate Limiting (RRL) throttles repetitive queries from suspicious sources.

Which CDN caching strategy is best suited for an API endpoint that returns user-specific data with a shared boilerplate section?

Answer: Edge Side Includes (ESI) to cache the shared section separately

ESI allows the CDN to cache the static boilerplate fragment while dynamically assembling the personalized portion from origin per request.

A CDN customer reports their origin server is receiving repeated requests for the same object at the same time after a TTL expiry — a 'thundering herd'. What CDN feature prevents this?

Answer: Request collapsing (request coalescing)

Request collapsing queues simultaneous cache-miss requests for the same object and forwards only one request to the origin, serving all waiters from the single response.

Which security mechanism allows a CDN to verify that a JWT token in an API request is valid before forwarding the request to the origin?

Answer: Edge-side JWT validation using the CDN's WAF or edge compute

Edge compute or WAF rules on the CDN can validate JWT signatures and claims before the request ever reaches the origin server.

What does 'Stale-While-Revalidate' allow a CDN to do when a cached object's TTL has just expired?

Answer: Serve the stale object while asynchronously fetching a fresh copy in the background

Stale-While-Revalidate lets the CDN serve the expired (stale) cached copy instantly while refreshing it in the background, eliminating the user-visible latency spike.

A CDN WAF detects a high volume of POST requests with SQL syntax in the body targeting a login endpoint. Which WAF action provides the best balance of security without impacting legitimate users?

Answer: Challenge suspected requests with a CAPTCHA or JS challenge before blocking

A challenge-based response (CAPTCHA/JS challenge) verifies whether the requester is human before blocking, reducing false positives against legitimate users.

Which metric best measures the effectiveness of a CDN's caching configuration at reducing origin load?

Answer: Cache Hit Ratio (CHR)

Cache Hit Ratio (CHR) is the percentage of requests served from cache versus total requests; a higher CHR means fewer requests reach the origin.