Practice Test Geeks(CDN) Content Delivery Network Certification Practice Test
← All CDN Flashcard Decks

SSL/TLS & Certificate Management Flashcards

7 cards from real CDN practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 SSL/TLS & Certificate Management flashcards as text

  1. A certificate has expired on a CDN edge node serving 50 PoPs. What is the most scalable remediation approach?

    Answer: Push the renewed certificate through the CDN's centralized certificate management API

    Centralized certificate management APIs propagate updated certificates to all PoPs simultaneously, making renewal scalable across large CDN networks.

  2. What is the purpose of a Certificate Revocation List (CRL) and what is its main drawback for CDN use?

    Answer: It lists revoked certificates; drawback is large file size and staleness causing latency

    CRLs list all revoked certificates from a CA, but they can grow very large and are updated infrequently, making real-time revocation checking unreliable.

  3. Which Diffie-Hellman variant is recommended for forward secrecy in modern CDN TLS configurations?

    Answer: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)

    ECDHE provides forward secrecy using ephemeral keys and is preferred because elliptic curve math offers strong security with smaller key sizes and better performance.

  4. A customer's domain uses CAA (Certification Authority Authorization) DNS records. What do these records control?

    Answer: Which Certificate Authorities are permitted to issue certificates for the domain

    CAA records let domain owners specify which CAs may issue certificates for their domain, preventing unauthorized certificate issuance.

  5. What is the difference between 'TLS offloading' and 'TLS passthrough' in CDN architecture?

    Answer: Offloading terminates TLS at the CDN edge; passthrough forwards encrypted traffic directly to origin

    TLS offloading decrypts traffic at the edge (enabling caching and WAF inspection), while passthrough forwards the encrypted stream unmodified to the origin.

  6. Why might a CDN enforce a minimum TLS version of 1.2 and deprecate TLS 1.0 and 1.1?

    Answer: TLS 1.0/1.1 have known vulnerabilities (POODLE, BEAST) and lack modern cipher support

    TLS 1.0 and 1.1 are vulnerable to attacks like POODLE and BEAST and do not support modern AEAD cipher suites, making them insecure for production use.

  7. What is 'mutual TLS' (mTLS) and in what CDN scenario is it most commonly applied?

    Answer: A handshake where both client and server present certificates for authentication

    mTLS requires both parties to authenticate with certificates, commonly used to secure CDN-to-origin connections or in zero-trust API gateway scenarios.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy