CDN Security & Performance Optimization 4 — Questions and Answers
Question 1: An attacker sends millions of small DNS queries to a CDN's authoritative nameservers to exhaust UDP processing capacity. Which mitigation is most appropriate?
- Increase DNS TTL to reduce query volume
- Deploy anycast DNS with rate limiting and response rate limiting (RRL) (Correct answer)
- Switch to TCP-only DNS
- Add more A records for the origin
Correct answer: Deploy anycast DNS with rate limiting and response rate limiting (RRL)
Anycast spreads the attack across multiple nodes while DNS Response Rate Limiting (RRL) throttles repetitive queries from suspicious sources.
Question 2: Which CDN caching strategy is best suited for an API endpoint that returns user-specific data with a shared boilerplate section?
- Full-page caching with long TTL
- Edge Side Includes (ESI) to cache the shared section separately (Correct answer)
- Bypass cache entirely for all API calls
- Cache only on the client browser
Correct answer: Edge Side Includes (ESI) to cache the shared section separately
ESI allows the CDN to cache the static boilerplate fragment while dynamically assembling the personalized portion from origin per request.
Question 3: A CDN customer reports their origin server is receiving repeated requests for the same object at the same time after a TTL expiry — a 'thundering herd'. What CDN feature prevents this?
- Request collapsing (request coalescing) (Correct answer)
- Prefetching before TTL expiry
- Increasing the cache TTL
- Enabling HTTP/2 push
Correct answer: Request collapsing (request coalescing)
Request collapsing queues simultaneous cache-miss requests for the same object and forwards only one request to the origin, serving all waiters from the single response.
Question 4: Which security mechanism allows a CDN to verify that a JWT token in an API request is valid before forwarding the request to the origin?
- IP allowlisting at the edge
- Edge-side JWT validation using the CDN's WAF or edge compute (Correct answer)
- Origin-side rate limiting
- SSL certificate pinning
Correct answer: Edge-side JWT validation using the CDN's WAF or edge compute
Edge compute or WAF rules on the CDN can validate JWT signatures and claims before the request ever reaches the origin server.
Question 5: What does 'Stale-While-Revalidate' allow a CDN to do when a cached object's TTL has just expired?
- Delete the object immediately and wait for a fresh fetch
- Serve the stale object while asynchronously fetching a fresh copy in the background (Correct answer)
- Redirect the user to the origin until the cache refreshes
- Serve a 503 error until the object is refreshed
Correct answer: Serve the stale object while asynchronously fetching a fresh copy in the background
Stale-While-Revalidate lets the CDN serve the expired (stale) cached copy instantly while refreshing it in the background, eliminating the user-visible latency spike.
Question 6: A CDN WAF detects a high volume of POST requests with SQL syntax in the body targeting a login endpoint. Which WAF action provides the best balance of security without impacting legitimate users?
- Block all POST requests to the login endpoint
- Challenge suspected requests with a CAPTCHA or JS challenge before blocking (Correct answer)
- Log the requests and alert the security team only
- Redirect all login traffic to a honeypot
Correct answer: Challenge suspected requests with a CAPTCHA or JS challenge before blocking
A challenge-based response (CAPTCHA/JS challenge) verifies whether the requester is human before blocking, reducing false positives against legitimate users.
Question 7: Which metric best measures the effectiveness of a CDN's caching configuration at reducing origin load?
- Time to First Byte (TTFB)
- Cache Hit Ratio (CHR) (Correct answer)
- DNS resolution time
- SSL handshake duration
Correct answer: Cache Hit Ratio (CHR)
Cache Hit Ratio (CHR) is the percentage of requests served from cache versus total requests; a higher CHR means fewer requests reach the origin.
CDN Security & Performance Optimization 4
An attacker sends millions of small DNS queries to a CDN's authoritative nameservers to exhaust UDP processing capacity.
Which mitigation is most appropriate?