CDN Security & Performance Optimization 3 — Questions and Answers
Question 1: When configuring a CDN WAF, what is the key difference between a 'detection mode' and a 'prevention mode' ruleset?
- Detection mode uses HTTPS; prevention mode uses HTTP
- Detection mode logs threats without blocking; prevention mode actively blocks (Correct answer)
- Detection mode applies to static assets; prevention mode to APIs
- Detection mode requires a paid plan; prevention mode is free
Correct answer: Detection mode logs threats without blocking; prevention mode actively blocks
In detection (monitoring) mode the WAF logs rule matches but passes traffic through; in prevention (blocking) mode matched requests are dropped.
Question 2: A CDN is configured to cache a page for 1 hour (max-age=3600). The origin sends a 'Cache-Control: no-store' header in a subsequent response. What should the CDN do?
- Serve the previously cached copy until the TTL expires
- Immediately purge the cached copy and not cache the new response (Correct answer)
- Cache the response but mark it private
- Override no-store and cache anyway based on CDN rules
Correct answer: Immediately purge the cached copy and not cache the new response
'no-store' instructs all caches including CDNs to neither store nor serve the response from cache; the object must be removed.
Question 3: Which CDN performance feature compresses the TCP slow-start window by reusing existing TCP connections between CDN POPs and the origin?
- Connection multiplexing via HTTP/2
- Persistent (keep-alive) connections with origin (Correct answer)
- Anycast routing
- SYN cookie protection
Correct answer: Persistent (keep-alive) connections with origin
Persistent connections between CDN edge nodes and origin avoid the TCP slow-start penalty on every new object fetch, reducing latency.
Question 4: What does 'cache key normalization' accomplish in CDN configuration?
- Encrypts the cache key before storage
- Removes irrelevant query parameters so equivalent URLs share a single cached object (Correct answer)
- Converts HTTPS requests to HTTP for origin fetching
- Ranks cached objects by popularity for eviction
Correct answer: Removes irrelevant query parameters so equivalent URLs share a single cached object
Cache key normalization strips or sorts query parameters that don't affect content, preventing redundant cache entries for the same effective resource.
Question 5: A financial services company requires that customer PII never be stored on CDN edge nodes. Which CDN configuration achieves this?
- Set max-age=0 and private cache-control on API responses (Correct answer)
- Enable Brotli compression on edge nodes
- Configure HTTP/3 for all API endpoints
- Enable prefetching for authenticated routes
Correct answer: Set max-age=0 and private cache-control on API responses
'Cache-Control: private, max-age=0' prevents CDN edge nodes from caching responses, ensuring PII stays only at the origin.
Question 6: Which CDN security feature validates that a resource loaded on a webpage matches a known cryptographic hash, protecting against supply chain attacks?
- Subresource Integrity (SRI) (Correct answer)
- Content Security Policy (CSP)
- CORS preflight validation
- Token-based URL signing
Correct answer: Subresource Integrity (SRI)
SRI lets browsers verify that a CDN-hosted script or stylesheet matches its expected hash, detecting tampering or substitution.
Question 7: What is the main advantage of using HTTP/3 (QUIC) over HTTP/2 for CDN-to-client delivery on lossy mobile networks?
- HTTP/3 supports more simultaneous connections
- HTTP/3 eliminates head-of-line blocking at the transport layer (Correct answer)
- HTTP/3 uses stronger encryption algorithms
- HTTP/3 reduces DNS lookup time
Correct answer: HTTP/3 eliminates head-of-line blocking at the transport layer
QUIC uses independent streams so a lost packet only blocks its own stream, unlike TCP where one loss stalls all HTTP/2 streams (head-of-line blocking).
CDN Security & Performance Optimization 3
When configuring a CDN WAF, what is the key difference between a 'detection mode' and a 'prevention mode' ruleset?