Security & Performance Optimization Flashcards

A CDN operator needs to prevent hotlinking — third-party sites embedding their customers' images. Which security feature is most effective?

Answer: Signed URL or Referer-based access control at the edge

Signed URLs (with expiry and token) or Referer header checking at the CDN edge blocks requests that don't originate from authorized domains.

What is the primary security risk addressed by enabling 'Origin Shielding' in a CDN configuration?

Answer: Prevents attackers from discovering and directly targeting the origin IP address

By routing all traffic through the CDN and keeping the origin IP hidden, shielding prevents attackers from bypassing the CDN to attack the origin directly.

Which CDN performance optimization technique proactively sends resources to the client before they are explicitly requested, based on predicted page dependencies?

Answer: Server Push (HTTP/2 Push) or Early Hints (103)

HTTP/2 Server Push and the 103 Early Hints status code allow the server or CDN to push critical resources before the browser has parsed the HTML and discovered them.

A CDN's edge node receives a request with the header 'Accept-Encoding: br, gzip'. Which compression format should the CDN prioritize for maximum compression ratio?

Answer: Brotli (br)

Brotli (br) typically achieves 15–25% better compression than gzip for text-based assets, reducing transfer size and improving load times.

What is a 'Cache Poisoning' attack in the context of CDN security?

Answer: Injecting malicious content into the CDN cache so it is served to legitimate users

Cache poisoning tricks the CDN into storing and serving a malicious or altered response, affecting all users who receive the cached content.

Which HTTP header should a CDN always strip from responses before caching to prevent leaking server-side implementation details?

Answer: X-Powered-By

The X-Powered-By header reveals backend technology (e.g., PHP/7.4, Express), providing attackers with information for targeted exploits; CDNs should strip it.

A global e-commerce site uses a CDN with 50 edge POPs. After a flash sale, they notice the CDN's cache hit ratio dropped to 20%. What is the most likely cause?

Answer: High request variance — too many unique URLs from personalization or query strings

When URLs contain unique parameters (session IDs, personalization tokens) each generates a distinct cache key, resulting in almost all requests being cache misses.