CDN Access Control & Token Authentication 2

Question 1

Which component in a CDN token-signing flow is considered the shared secret and must never be exposed publicly?

Accepted Answer

The HMAC signing key stored on both the origin application and CDN configuration

Answer

The CDN edge node's IP address

Answer

The user's session cookie value

Answer

The expiry timestamp appended to the URL

Question 2

A CDN operator wants to restrict content so that a signed URL can only be used from the IP address that originally requested it. Which token parameter enables this binding?

Accepted Answer

ip_acl or client_ip parameter included in the token signature

Answer

The Cache-Control: private header

Answer

A Vary: X-Forwarded-For response header from the origin

Answer

Setting a short TTL of 1 second on the signed URL

Question 3

What is 'token escalation' in the context of CDN security?

Accepted Answer

An attack where a low-privilege token is manipulated to gain access to restricted content

Answer

Automatically renewing expired tokens without user interaction

Answer

Upgrading a CDN plan to unlock token-based authentication features

Answer

The process of increasing token expiry time during high-traffic events

Question 4

For an OTT platform using a CDN, why is it recommended to use short-lived signed URLs (e.g., 5–15 minute expiry) for video segment delivery?

Accepted Answer

Short expiry minimizes the window during which a leaked URL can be exploited by unauthorized users

Answer

Short-lived URLs improve CDN cache hit ratios

Answer

CDN pricing is lower for URLs with shorter TTL values

Answer

Short-lived URLs force the CDN to revalidate content freshness more frequently

Question 5

Which HTTP status code should a CDN return when a request is blocked due to a geo-restriction rule?

Accepted Answer

451 Unavailable For Legal Reasons

Answer

401 Unauthorized

Answer

403 Forbidden

Answer

404 Not Found

Question 6

A company wants CDN edge nodes to authenticate API consumers without hitting the origin. Which approach allows stateless token verification at the edge?

Accepted Answer

JWT tokens signed with a key the CDN edge nodes possess for local verification

Answer

OAuth 2.0 authorization code flow with origin callback

Answer

Session cookies stored in a shared Redis cluster accessible to all edge nodes

Answer

HTTP Basic Authentication forwarded transparently to the origin

Question 7

What is a 'wildcard token' in CDN access control?

Accepted Answer

A signed token where the path parameter uses a prefix or wildcard pattern to cover multiple resources

Answer

A token that can be used an unlimited number of times regardless of expiry

Answer

A master API key that bypasses all CDN security rules

Answer

A token type that works across different CDN vendors without modification