CDN Access Control & Token Authentication 3

Question 1

When integrating DRM (Digital Rights Management) with a CDN for premium video delivery, what role does the CDN typically play?

Accepted Answer

The CDN delivers encrypted content while a separate DRM license server handles key issuance to authenticated clients

Answer

The CDN generates DRM licenses on behalf of the content owner

Answer

The CDN decrypts content at the edge and re-encrypts it per-user to enforce DRM

Answer

The CDN replaces DRM entirely by using signed URLs for all video segments

Question 2

What is the primary security risk of using long-lived (e.g., 30-day) signed URLs for distributing downloadable software installers?

Accepted Answer

The signed URL can be freely shared or reposted, allowing unlimited unauthorized downloads during the valid period

Answer

Long TTLs cause CDN cache pollution and increased storage costs

Answer

Long-lived tokens are incompatible with HTTPS and require HTTP delivery

Answer

CDN edges automatically invalidate tokens longer than 24 hours for security compliance

Question 3

Which CDN access control method involves configuring an allowlist of trusted IP ranges (e.g., corporate office CIDRs) at the edge?

Accepted Answer

IP-based ACL (Access Control List)

Answer

Token authentication

Answer

Referrer whitelisting

Answer

Mutual TLS (mTLS)

Question 4

Mutual TLS (mTLS) at the CDN edge is most appropriate for which use case?

Accepted Answer

Securing machine-to-machine API communication between known services and the CDN edge

Answer

Authenticating end consumers visiting a public e-commerce website

Answer

Replacing signed URL tokens for video streaming to mobile devices

Answer

Speeding up TLS handshakes for anonymous users by skipping certificate verification

Question 5

A CDN supports 'token revocation' by checking tokens against a blocklist. What is the main operational challenge of this approach?

Accepted Answer

The blocklist must be replicated to all edge nodes globally with low latency, adding complexity and potential inconsistency

Answer

Token blocklists cannot be stored in databases larger than 1,000 entries

Answer

Revoked tokens automatically reactivate after 24 hours due to CDN cache TTL

Answer

Token revocation requires the origin to regenerate all active tokens simultaneously

Question 6

When a CDN is configured to pass an `Authorization` header from the client directly to the origin, what caching consideration is critical?

Accepted Answer

Responses to authorized requests must not be served from cache to other users; caching should be disabled or vary on the Authorization header

Answer

The CDN should cache responses regardless of the Authorization header to maximize hit ratio

Answer

The CDN must base64-decode the Authorization header before forwarding it to the origin

Answer

Authorization headers automatically trigger CDN edge node failover to secondary origins

Question 7

Which feature allows a CDN to enforce access control rules based on custom request attributes (e.g., query string values, custom headers) without modifying the origin application?

Accepted Answer

CDN Rules Engine (also called Edge Rules or Edge Logic)

Answer

Origin shield

Answer

Anycast routing

Answer

Cache warming