CDN DNS & Domain Management 4

Question 1

Which DNS record type is used by CDNs to publish SPF policy when the CDN sends email on behalf of a customer domain?

Accepted Answer

TXT

Answer

SPF policies are stored in TXT records and list authorized mail-sending IP ranges, including those used by CDN-hosted email services.

Question 2

What is the purpose of a CAA (Certification Authority Authorization) DNS record in a CDN deployment?

Accepted Answer

It restricts which certificate authorities may issue TLS certificates for the domain

Answer

CAA records prevent unauthorized CAs from issuing certificates for your domain, reducing TLS hijacking risk.

Question 3

During a CDN failover, a TTL of 30 seconds on the primary A record was set in advance. What is the maximum time a client could still reach the failed origin after the DNS update?

Accepted Answer

30 seconds

Answer

Clients cache DNS responses for the duration of the TTL, so a 30-second TTL means at most 30 seconds before the new record is fetched.

Question 4

What is DNS anycast and why do CDNs use it?

Accepted Answer

Multiple servers share the same IP; BGP routes users to the topologically nearest one

Answer

Anycast assigns identical IPs to multiple PoPs; BGP ensures each user's query reaches the geographically or topologically closest PoP.

Question 5

A CDN customer's subdomain media.example.com must be decommissioned, but its CNAME still points to the CDN edge. What security risk does this create?

Accepted Answer

Subdomain takeover — an attacker can claim the CDN hostname and serve content under media.example.com

Answer

If the CDN hostname is released and an attacker re-registers it, the dangling CNAME lets them hijack the subdomain.

(CDN) Content Delivery Network Certification Practice Test

(CDN) Content Delivery Network Certification Practice Test

CDN DNS & Domain Management 4