CDN Security & Performance Optimization 5 — Questions and Answers
Question 1: A CDN operator needs to prevent hotlinking — third-party sites embedding their customers' images. Which security feature is most effective?
- Geo-blocking all foreign IPs
- Signed URL or Referer-based access control at the edge (Correct answer)
- Disabling HTTP caching for images
- Enabling HTTP/2 for image delivery
Correct answer: Signed URL or Referer-based access control at the edge
Signed URLs (with expiry and token) or Referer header checking at the CDN edge blocks requests that don't originate from authorized domains.
Question 2: What is the primary security risk addressed by enabling 'Origin Shielding' in a CDN configuration?
- Reduces TLS certificate exposure
- Prevents attackers from discovering and directly targeting the origin IP address (Correct answer)
- Encrypts data at rest on edge nodes
- Stops cache poisoning attacks
Correct answer: Prevents attackers from discovering and directly targeting the origin IP address
By routing all traffic through the CDN and keeping the origin IP hidden, shielding prevents attackers from bypassing the CDN to attack the origin directly.
Question 3: Which CDN performance optimization technique proactively sends resources to the client before they are explicitly requested, based on predicted page dependencies?
- Lazy loading
- Server Push (HTTP/2 Push) or Early Hints (103) (Correct answer)
- Prefetch DNS
- Stale-While-Revalidate
Correct answer: Server Push (HTTP/2 Push) or Early Hints (103)
HTTP/2 Server Push and the 103 Early Hints status code allow the server or CDN to push critical resources before the browser has parsed the HTML and discovered them.
Question 4: A CDN's edge node receives a request with the header 'Accept-Encoding: br, gzip'. Which compression format should the CDN prioritize for maximum compression ratio?
- gzip
- deflate
- Brotli (br) (Correct answer)
- zstd
Correct answer: Brotli (br)
Brotli (br) typically achieves 15–25% better compression than gzip for text-based assets, reducing transfer size and improving load times.
Question 5: What is a 'Cache Poisoning' attack in the context of CDN security?
- Flooding the CDN with requests to exhaust cache storage
- Injecting malicious content into the CDN cache so it is served to legitimate users (Correct answer)
- Stealing session tokens cached on the edge node
- Manipulating DNS records to redirect CDN traffic
Correct answer: Injecting malicious content into the CDN cache so it is served to legitimate users
Cache poisoning tricks the CDN into storing and serving a malicious or altered response, affecting all users who receive the cached content.
Question 6: Which HTTP header should a CDN always strip from responses before caching to prevent leaking server-side implementation details?
- Cache-Control
- X-Powered-By (Correct answer)
- Content-Type
- ETag
Correct answer: X-Powered-By
The X-Powered-By header reveals backend technology (e.g., PHP/7.4, Express), providing attackers with information for targeted exploits; CDNs should strip it.
Question 7: A global e-commerce site uses a CDN with 50 edge POPs. After a flash sale, they notice the CDN's cache hit ratio dropped to 20%. What is the most likely cause?
- The CDN's TLS certificates expired
- High request variance — too many unique URLs from personalization or query strings (Correct answer)
- The origin server was unreachable
- HTTP/2 multiplexing was disabled
Correct answer: High request variance — too many unique URLs from personalization or query strings
When URLs contain unique parameters (session IDs, personalization tokens) each generates a distinct cache key, resulting in almost all requests being cache misses.
CDN Security & Performance Optimization 5
A CDN operator needs to prevent hotlinking — third-party sites embedding their customers' images.
Which security feature is most effective?