CDN Security & Performance Optimization 2 — Questions and Answers
Question 1: Which TLS feature allows a CDN edge server to send the certificate status during the handshake, eliminating a separate OCSP lookup by the client?
- Certificate Pinning
- OCSP Stapling (Correct answer)
- HPKP
- CT Log Submission
Correct answer: OCSP Stapling
OCSP Stapling lets the server attach a cached OCSP response to the TLS handshake, removing the client's need to query a CA.
Question 2: A CDN operator wants to prevent attackers from exploiting vulnerabilities in old TLS versions. Which minimum protocol version is recommended by current industry best practice?
- SSL 3.0
- TLS 1.0
- TLS 1.2 (Correct answer)
- TLS 1.3
Correct answer: TLS 1.2
TLS 1.2 is the current minimum recommended by NIST and major CDN vendors; TLS 1.3 is preferred where supported.
Question 3: What does a CDN's Bot Management system use to distinguish legitimate users from automated scrapers?
- IP geolocation only
- Behavioral fingerprinting and challenge-response (Correct answer)
- DNS TTL analysis
- HTTP keep-alive timeouts
Correct answer: Behavioral fingerprinting and challenge-response
Bot management combines behavioral signals (mouse movement, request cadence) with challenges like CAPTCHAs or JS challenges to identify bots.
Question 4: Which HTTP response header instructs browsers to only connect to a site over HTTPS for a specified duration, even if the user types HTTP?
- Content-Security-Policy
- X-Frame-Options
- Strict-Transport-Security (Correct answer)
- X-Content-Type-Options
Correct answer: Strict-Transport-Security
The Strict-Transport-Security (HSTS) header tells browsers to enforce HTTPS connections for the specified max-age duration.
Question 5: A retail site experiences slow Time to First Byte (TTFB) during peak sales. Which CDN technique most directly reduces TTFB for cacheable responses?
- Image lazy loading
- Edge caching with cache HIT serving (Correct answer)
- TCP connection pooling to origin
- HTTP/2 server push
Correct answer: Edge caching with cache HIT serving
When a CDN serves a cached HIT from an edge node close to the user, TTFB drops dramatically because no origin round-trip is needed.
Question 6: What is the purpose of a CDN's 'Shield' or 'Mid-tier Cache' architecture?
- Encrypt traffic between CDN and origin
- Consolidate cache MISS requests to a single POP before hitting origin (Correct answer)
- Block DDoS at the network layer
- Compress responses before delivery
Correct answer: Consolidate cache MISS requests to a single POP before hitting origin
A shield POP acts as an intermediate cache layer, so only one request per unique object reaches the origin even if many edge nodes miss simultaneously.
Question 7: Which attack specifically targets the CDN caching layer by sending requests with unique cache-busting parameters to force repeated origin fetches?
- Cache Poisoning
- Cache Deception
- Cache Bypass / Cache Busting Attack (Correct answer)
- Slowloris Attack
Correct answer: Cache Bypass / Cache Busting Attack
A cache bypass attack appends random query strings to every request, ensuring cache misses that overwhelm the origin server.
CDN Security & Performance Optimization 2
Which TLS feature allows a CDN edge server to send the certificate status during the handshake, eliminating a separate OCSP lookup by the client?