CDN SSL/TLS & Certificate Management 2

Question 1

What is the purpose of OCSP stapling in a CDN environment?

Accepted Answer

To allow the server to cache and serve certificate revocation status directly

Answer

OCSP stapling lets the server cache and attach the certificate revocation response to the TLS handshake, reducing latency and load on OCSP responders.

Question 2

Which TLS extension allows a CDN to serve multiple SSL certificates on a single IP address?

Accepted Answer

Server Name Indication (SNI)

Answer

SNI allows the client to send the requested hostname during the TLS handshake, enabling the server to select the correct certificate for that domain.

Question 3

What does 'certificate pinning' achieve in a CDN security context?

Accepted Answer

Forces clients to accept only a pre-approved certificate or public key

Answer

Certificate pinning instructs clients to reject any certificate not matching a pinned value, preventing MITM attacks using rogue certificates.

Question 4

A CDN operator needs to inspect encrypted HTTPS traffic for WAF purposes. Which technique makes this possible?

Accepted Answer

TLS termination at the edge

Answer

TLS termination at the CDN edge decrypts traffic so the WAF can inspect it before re-encrypting and forwarding to the origin.

Question 5

What is the risk of using a wildcard certificate (*.example.com) across a CDN with many PoPs?

Accepted Answer

Compromise of one PoP exposes the private key for all subdomains

Answer

A single wildcard private key stored across many PoPs means a breach at any single PoP compromises all subdomains covered by that certificate.

(CDN) Content Delivery Network Certification Practice Test

(CDN) Content Delivery Network Certification Practice Test

CDN SSL/TLS & Certificate Management 2