CDN Access Control & Token Authentication 3

Question 1

When integrating DRM (Digital Rights Management) with a CDN for premium video delivery, what role does the CDN typically play?

Accepted Answer

The CDN delivers encrypted content while a separate DRM license server handles key issuance to authenticated clients

Answer

In a CDN-DRM architecture, the CDN efficiently distributes encrypted content at scale while the DRM license server (Widevine, FairPlay, PlayReady) issues decryption keys only to authenticated, authorized clients.

Question 2

What is the primary security risk of using long-lived (e.g., 30-day) signed URLs for distributing downloadable software installers?

Accepted Answer

The signed URL can be freely shared or reposted, allowing unlimited unauthorized downloads during the valid period

Answer

A long-lived signed URL can be redistributed (e.g., posted on forums) and used by anyone during the entire validity window, undermining access control for paid or restricted content.

Question 3

Which CDN access control method involves configuring an allowlist of trusted IP ranges (e.g., corporate office CIDRs) at the edge?

Accepted Answer

IP-based ACL (Access Control List)

Answer

IP-based ACLs configure CDN edge nodes to allow or deny requests based on the client's source IP address or CIDR range, commonly used to restrict access to internal tools or B2B APIs.

Question 4

Mutual TLS (mTLS) at the CDN edge is most appropriate for which use case?

Accepted Answer

Securing machine-to-machine API communication between known services and the CDN edge

Answer

mTLS requires both parties to present X.509 certificates, making it ideal for B2B or service-to-service scenarios where all clients are known and can be issued client certificates.

Question 5

A CDN supports 'token revocation' by checking tokens against a blocklist. What is the main operational challenge of this approach?

Accepted Answer

The blocklist must be replicated to all edge nodes globally with low latency, adding complexity and potential inconsistency

Answer

Distributing a token blocklist to potentially hundreds of globally distributed edge PoPs in near-real-time is operationally complex and can introduce a revocation lag during propagation.

(CDN) Content Delivery Network Certification Practice Test

(CDN) Content Delivery Network Certification Practice Test

CDN Access Control & Token Authentication 3