CDN Expert
What is a 'Point of Presence' (PoP) in the context of a CDN, and how does it differ from a traditional data center?
Select the correct answer
A centralized hub that processes all database writes before replicating them out globally.
A backup site that mirrors the primary data center for disaster recovery purposes alone.
A cluster of edge servers placed near users to cache and serve content with low latency.
A single large facility that stores an application's complete data and all its services.
What is a PoP (Point of Presence), and how does it differ from a single edge server?
Select the correct answer
A PoP is a location housing many edge servers and gear; an edge server is one machine inside.
A PoP is a single high-capacity server and an edge server is a smaller regional replica of it.
A PoP is the origin's regional mirror while an edge server only handles DNS lookups for users.
A PoP is a software router while an edge server is the physical hardware that runs caching.
Explain the concept of an 'Origin Shield' (or Tiered Caching). Why would a high-traffic site implement this between their edge and their origin?
Select the correct answer
A DNS routing system that directs each user to their geographically nearest edge node.
A standby origin server that serves all content whenever the primary origin goes offline.
A dedicated firewall tier that filters malicious requests before they reach the origin.
An intermediate cache that consolidates edge misses so the origin gets far fewer requests.
What is the difference between the 'Control Plane' and the 'Data Plane' in a CDN?
Select the correct answer
The control plane serves end users while the data plane synchronizes caches between regions.
The control plane handles TLS termination while the data plane manages DNS resolution rules.
The control plane manages configuration and routing while the data plane delivers content.
The control plane caches static assets while the data plane forwards dynamic requests on.
How does a CDN perform load balancing and failover across its edge servers, and what role do health checks play?
Select the correct answer
Health checks count active connections so new sessions are billed to the correct customer.
Health checks validate cached content freshness so stale objects get purged automatically.
Health checks measure user latency so requests always travel to the fastest origin server.
Health checks detect failing servers so traffic is rerouted to healthy nodes for failover.
What is a CDN and what are the primary problems it solves for a modern web application?
Select the correct answer
A distributed server network that caches content near users to cut latency and offload origin.
A DNS provider that resolves domain names quickly by storing records in many locations now.
A managed database service that replicates writes across regions to ensure data durability.
A security gateway that inspects every request to block attacks before reaching the backend.
What is an 'Edge Server' (or PoP) and how does it differ from an 'Origin Server'?
Select the correct answer
The edge caches and serves content near users; the origin is the authoritative content source.
The edge generates dynamic pages; the origin merely forwards static assets to the browsers.
The edge stores the original files; the origin only handles overflow traffic during spikes.
The edge resolves DNS queries for clients; the origin balances load across the edge servers.
What is Time To First Byte (TTFB), and how does putting a CDN in front of your origin affect it?
Select the correct answer
Time until the page fully renders; a CDN improves it only for dynamic content.
Time until the first response byte arrives; a CDN edge cache usually lowers it.
Time to establish a TCP connection; a CDN has no measurable effect on it at all.
Time to download the full response; a CDN raises it due to extra network hops.
In the context of a CDN, what is the 'Last Mile' vs. the 'Middle Mile' problem?
Select the correct answer
Last mile is the edge-to-origin hop; middle mile is the user's connection to their local ISP.
Last mile is the origin's database query; middle mile is the cache lookup performed at the edge.
Last mile is the TLS handshake time; middle mile is the time spent rendering content in browser.
Last mile is the user-to-edge link; middle mile is the path from edge to the origin server.
When would you NOT want to use a CDN for a specific type of data or application?
Select the correct answer
When large media files must reach users located far from the origin server.
When serving static assets to a globally distributed audience across many regions.
When traffic is bursty and you need to absorb sudden spikes in user demand.
When content is unique per user and rarely reused, caching gives little benefit.
What are the primary tradeoffs of adding a CDN to your stack?
Select the correct answer
Better security traded against guaranteed downtime and total loss of analytics.
Faster delivery traded against added cost, complexity, and cache staleness risk.
Cheaper hosting traded against higher latency and frequent complete origin outages.
Slower delivery traded against lower cost, simpler setup, and always-fresh data.
How does a CDN reduce origin bandwidth and load, and how would you quantify the offload it provides?
Select the correct answer
Edge serves cached hits; offload is measured by the cache hit ratio of bytes served.
Edge rewrites requests; offload is measured by the number of edge POPs deployed.
Origin shards traffic; offload is measured by the total concurrent user connections.
Origin compresses responses; offload is measured by the average response time gain.
What is the difference between a 'Push CDN' and a 'Pull CDN', and in what scenarios would you choose one over the other?
Select the correct answer
Push runs at the origin server; pull runs entirely within the user's browser cache.
Push caches dynamic content; pull caches only static images and large video files.
Push fetches content on first request; pull replicates the entire origin nightly.
Push uploads content to the CDN ahead of time; pull fetches it on first cache miss.
Can a CDN accelerate dynamic (non-cacheable) content? Explain 'Dynamic Site Acceleration' (DSA).
Select the correct answer
Yes; DSA optimizes the network path and connections rather than caching content.
Yes; DSA caches dynamic responses briefly at edge to serve repeat visitors fast.
No; DSA only compresses payloads at the origin before sending them across the wire.
No; dynamic content cannot be accelerated because it is never cacheable at edge.
How do CDNs perform 'Image Optimization' at the edge (e.g., WebP conversion, resizing) and why is it better than doing it on the fly at the origin?
Select the correct answer
Edge compresses files once at origin upload, requiring manual variant generation later.
Origin transforms each request live, which the edge caches but never offloads CPU from.
Edge transforms and caches variants near users, sparing origin CPU and cutting latency.
Edge stores only original files and resizes inside each user's browser on demand.
How does a CDN handle large file delivery (like 5GB video files) differently than small images?
Select the correct answer
Large files bypass the cache entirely and stream directly from the origin server.
Large files use byte-range requests and chunked caching rather than whole-object.
Large files are compressed at the edge while small images are always served raw.
Large files are split across multiple POPs while small files stay on a single POP.
What is 'Hotlinking' and how can a CDN prevent other sites from stealing your bandwidth?
Select the correct answer
Embedding your assets on another site; the CDN blocks it by checking the Referer header.
Caching stale content on third parties; the CDN prevents it by shortening the TTL on every object.
Hijacking your DNS records remotely; the CDN prevents it by enforcing DNSSEC across all the zones.
Scraping your rendered HTML pages; the CDN prevents it by rate-limiting all known crawler IP ranges.
Explain how 'Signed URLs' or 'Signed Cookies' work to protect premium/private content delivered via CDN.
Select the correct answer
They redirect users to an auth server that issues a session token before any content is ever served.
They embed a cryptographic signature and expiry that the edge validates before serving the content.
They place the user credentials in the URL so the origin re-verifies each request against its store.
They encrypt the file contents end-to-end so only clients holding the decryption key can view them.
What is the role of a Web Application Firewall (WAF) when deployed at the CDN edge compared to a WAF on the application server?
Select the correct answer
An edge WAF removes the need for any origin security because traffic is already fully authenticated.
An edge WAF only inspects TLS handshakes while the origin WAF decrypts and scans the full payload.
An edge WAF filters malicious requests near users before they reach origin, cutting load and latency.
An edge WAF caches the blocked requests so that repeated attacks are served faster from edge cache.
When would you use 'Signed URLs' versus 'Signed Cookies' for content protection?
Select the correct answer
Use signed URLs for streaming video segments; use signed cookies for static image and CSS assets.
Use signed URLs for many files at once; use signed cookies only for one-time single-file downloads.
Use signed URLs for a single file; use signed cookies to grant access to many files at once.
Use signed URLs when content is public; use signed cookies when content must be encrypted at rest.
What is rate limiting at the edge, and why is enforcing it at the CDN more effective than at the origin?
Select the correct answer
It queues excess requests at the origin and replays them slowly once traffic returns to normal.
It caps request rates per client at the edge, stopping abuse before it reaches origin resources.
It caps the origin's outbound bandwidth so the server never exceeds its provisioned transfer limit.
It throttles only cached responses at the edge while sending uncached requests straight to origin.
What is bot management, and how does a CDN distinguish and mitigate malicious bots at the edge?
Select the correct answer
It inspects only the User-Agent string and trusts any request claiming to be a search engine.
It relies solely on a static IP blocklist updated nightly to drop traffic from known bad networks.
It identifies bots via fingerprinting, behavior, and challenges, blocking malicious ones at the edge.
It blocks every automated client by default, forcing all bots including crawlers to register a key.
How does a CDN provide DDoS mitigation, and what is the difference between absorbing a volumetric attack at the edge vs. at the origin?
Select the correct answer
The CDN forwards the flood to the origin, which adds bandwidth to absorb and survive the attack itself.
Absorbing at the origin scales better since one tuned server filters packets faster than spread edges.
Edge absorption handles only application-layer floods while the origin must soak up all volumetric ones.
Edge PoPs absorb and disperse attack traffic across the global network, shielding the limited origin.
What metrics are most important for evaluating a CDN's effectiveness?
Select the correct answer
Origin CPU usage, RAM consumption, disk I/O, and database query times only.
HTML page size, image compression ratio, script bundle count, and font loads.
Number of edge POPs, total contract cost, vendor SLA tier, and brand reputation.
Cache hit ratio, latency or TTFB, throughput, and error rates across edge locations.
How do you define and measure 'Cache Hit Ratio', and what are three common reasons it might be lower than expected?
Select the correct answer
Hits divided by origin requests; lowered by large objects, bandwidth caps, and DNS issues.
Misses divided by total requests; lowered by long TTLs, shared keys, and rare purges.
Hits divided by total requests; lowered by short TTLs, fragmented keys, and frequent purges.
Edge bytes over total bytes; lowered by TLS overhead, gzip cost, and slow origins.
How do you debug a 'Cache Miss' that you expected to be a 'Cache Hit'? Walk me through your diagnostic process.
Select the correct answer
Restart the origin server, clear the browser cache, and increase origin memory allocation.
Disable caching entirely, then re-enable it and monitor the origin CPU for spikes.
Upgrade the CDN plan, add more edge locations, and enable HTTP/2 on the origin server.
Inspect cache headers, then verify the cache key, TTL, and Vary configuration.
What is 'Cache Hit Ratio' (CHR) and what are three specific ways you can improve it?
Select the correct answer
Ratio of bytes to objects; improve via image compression, minification, and tiered caches.
Ratio of origin to edge hits; improve via more POPs, faster DNS, and TLS session reuse.
Ratio of misses to requests; improve via shorter TTLs, unique keys, and frequent purging.
Ratio of hits to requests; improve via longer TTLs, normalized keys, and cacheable responses.
If a user reports a slow site but the origin server has low CPU/RAM usage, how would you use CDN logs to investigate?
Select the correct answer
Analyze origin logs for slow SQL queries, thread pools, and garbage collection pauses.
Analyze DNS logs for resolution delays, TTL expiry, and recursive resolver failures.
Analyze edge logs for cache miss rates, TTFB, status codes, and per-region latency.
Analyze browser logs for render-blocking scripts, layout shifts, and paint timings.
What is the 'Thundering Herd' problem in a CDN context, and how does 'Request Collapsing' (or Cache Lock) prevent it?
Select the correct answer
On a cache miss many requests hit origin at once; collapsing forwards one and shares its response.
On expiry the CDN preemptively refetches every object, so collapsing avoids serving any stale data.
On startup cold edges flood origin, so collapsing delays them until the cache is fully warmed up.
On a cache hit edges duplicate the response, so collapsing drops the extra copies to save memory.
How does a CDN decide when to fetch a new version of a file from the origin?
Select the correct answer
When the object's TTL expires or it is purged, it revalidates or re-fetches from the origin
When a fixed scheduled interval elapses, the edge discards all cached objects and reloads them together
When the origin server actively pushes a notification to every edge node telling it the file has changed
When the edge node compares each stored file's checksum against the origin on every incoming user request
How does the origin use Cache-Control headers to signal the CDN what is cacheable and for how long?
Select the correct answer
Directives like max-age, s-maxage, private and no-store set cacheability and freshness
The Host header lists which edge regions may cache the object and for how many minutes each one may keep it
The origin embeds expiry timestamps inside the response body which the CDN parses to decide caching duration
The origin sets a Content-Length value that tells each edge node exactly how many seconds the object stays fresh
Explain the 'Vary' header. How does it influence how a CDN stores and serves different versions of a resource?
Select the correct answer
It instructs caches how long to retain a resource before revalidating with origin.
It instructs caches to bypass storage entirely and always fetch from the origin.
It instructs caches to compress responses based on the client's bandwidth limit.
It instructs caches to store separate variants keyed by the listed request headers.
What is a 'Cache Key' and how do query strings or headers like User-Agent affect cache fragmentation?
Select the correct answer
Identifier for a cached object; including query strings or User-Agent multiplies variants.
Compression setting for a cached object; query strings and User-Agent shrink each variant.
Expiration timer for a cached object; query strings and User-Agent extend its lifetime.
Encryption token for a cached object; query strings and User-Agent secure each variant.
What is 'Negative Caching' and why is it important for a CDN?
Select the correct answer
Caching only successful responses and dropping all error codes so clients always retry against the origin
Storing stale copies of objects so they can be served whenever the origin becomes completely unreachable
Caching error responses like 404 or 500 briefly to shield the origin from repeated failing requests
Refusing to cache any content from origins that have previously returned slow or failing responses to users
Explain 'Cache Key Normalization'. Why would you want to strip certain query parameters at the edge?
Select the correct answer
Removing irrelevant params (e.g. tracking tags) so equivalent URLs map to one cache entry, raising hit ratio
Encrypting query parameters before they are stored so that the cache key cannot leak sensitive user data
Adding extra parameters to each URL so every visitor receives a uniquely personalized cached response object
Sorting query parameters alphabetically so the origin can validate request signatures more reliably at scale
What is 'Cache Poisoning,' and how can misconfigured CDN cache keys lead to it?
Select the correct answer
Leaking private cached responses to users because TLS certificates expired silently.
Overloading the cache with junk objects so legitimate content gets evicted early.
Encrypting cached responses so that users cannot decrypt them without a key token.
Serving a malicious cached response to users when unkeyed inputs alter the response.
Explain the difference between a 'Hard Purge' and a 'Soft Purge' (Invalidation vs. Revalidation).
Select the correct answer
Hard purge applies to static assets and soft purge applies exclusively to dynamic API responses on the edge
Hard purge removes objects after their TTL expires while soft purge removes them before the TTL has elapsed
Hard purge deletes content immediately; soft purge marks it stale so it is revalidated on next request
Hard purge clears only the origin's cache while soft purge clears every edge node's cache simultaneously fast
Explain the 'stale-while-revalidate' directive and how it improves the user experience compared to a standard TTL.
Select the correct answer
It blocks the user request at the edge until the origin confirms the content is still fresh and unchanged
It serves stale content instantly while asynchronously fetching a fresh copy, avoiding latency on expiry
It extends the original TTL by a fixed window so the object never actually expires until traffic stops
It revalidates every cached object on a background timer regardless of whether any user has requested it
What is the difference between Cache Invalidation (Purging) and Cache Expiration (TTL), and which is more expensive for a global CDN?
Select the correct answer
Both rely on the same TTL timer internally, so neither is more expensive than the other at global scale
Expiration actively pushes removals to all nodes while purging waits for the TTL, making expiration costlier
Expiration removes content passively by time; purging actively forces removal across edges and costs more
Purging only affects one edge node at a time so it is far cheaper than letting content expire globally
Explain the 'stale-if-error' directive and how a CDN uses it to keep serving content when the origin is unavailable.
Select the correct answer
It lets the CDN serve an expired cached copy when the origin returns errors or is unreachable
It forces the CDN to purge stale objects immediately whenever the origin begins returning error codes
It instructs the CDN to retry the origin repeatedly until a fresh non-error response is finally returned
It tells the browser to ignore all cache rules and always fetch content directly from the origin
Explain 'Tag-based Invalidation' (Surrogate Keys). Why is it more efficient than URL-based purging?
Select the correct answer
Tags compress many URLs into a single object so less storage is needed and purging therefore frees more space
Objects are tagged with keys, so one tag purge clears all related URLs in a single operation
Tags let the origin skip revalidation entirely because tagged objects are always treated as permanently fresh
Each tag stores a shorter cache key than a full URL, which lets the edge index and look up objects faster
How does a CDN handle a 'Flash Crowd' or a sudden viral traffic spike without crashing the origin?
Select the correct answer
Edges serve most requests from cache and collapse concurrent misses into one origin fetch via request coalescing
Edges queue all viral traffic and replay it slowly to the origin once the demand spike has fully subsided
Edges forward every incoming request straight to the origin but spread them evenly using round-robin load balancing
Edges automatically block a portion of users with rate limits so the origin only ever sees baseline traffic
How would you use a CDN to implement 'Geo-fencing' or localized content delivery?
Select the correct answer
Use edge logic on the client's geolocation to serve, redirect, or block content based on country or region
Use the browser's stored language preference exclusively, ignoring the client IP and edge location entirely
Use origin-only checks that inspect each request's location after the CDN has already returned its cached copy
Use a single shared cache key for all regions so every user worldwide receives identical localized content
How does a CDN handle 'Cold Starts' and what is 'Cache Warming'?
Select the correct answer
A cold start is a TLS handshake delay, and warming means keeping persistent connections open to every client
A cold start is an empty edge cache causing origin fetches; warming pre-loads content so early users hit cache
A cold start is an overloaded origin server, and warming means scaling up extra origin capacity in advance
A cold start is expired DNS records, and warming means refreshing those records before users begin requesting
How does a CDN actually route a user to the 'closest' edge server? Explain the difference between Anycast and GeoDNS-based routing.
Select the correct answer
Anycast advertises one IP from many sites so routing picks the nearest, while GeoDNS returns different IPs by client location
Anycast measures latency at the TCP layer while GeoDNS measures it at the HTTP layer to find the closest server
Both Anycast and GeoDNS rely solely on browser geolocation APIs to choose which edge server should handle a request
Anycast returns a different IP per region via DNS, while GeoDNS shares one IP that network routing directs to nearest node
What are the performance benefits of terminating TLS/SSL at the edge rather than at the origin?
Select the correct answer
The handshake happens close to the user, cutting round-trip latency and offloading crypto work from the origin
The certificate is validated only once globally, so individual users avoid repeating any handshake round-trips
The handshake is skipped entirely for nearby users, removing all encryption overhead between client and edge
The origin handles every handshake but the edge caches the negotiated session keys for all future visitors
How does a CDN use 'Connection Reuse' (Keep-Alive) between the edge and the origin to improve performance?
Select the correct answer
It keeps open connections in a pool so subsequent origin fetches skip repeated TCP and TLS handshakes
It opens a brand new connection per request but caches the TLS certificate so verification can be skipped
It merges many origin requests onto one connection so the origin only ever processes a single response
It holds the client browser connection open indefinitely so the origin never needs to respond more than once
What are the tradeoffs of enabling 'Edge Minification' or Brotli/Gzip compression at the CDN layer?
Select the correct answer
It cuts payload size and speeds delivery but costs edge CPU and complicates caching of variants.
It guarantees smaller payloads at zero CPU cost since edge nodes compress all content for free.
It always improves security by encrypting assets while shrinking them before reaching clients.
It removes the need for origin compression and never affects cache hit ratios or content types.
What is 'Brotli' or 'Gzip' compression at the edge, and why is it better to do it there than at the origin?
Select the correct answer
Compressing at the edge raises origin bandwidth because each request recompresses content fresh.
Compressing at the edge offloads origin CPU and reuses compressed cached objects across users.
Compressing at the edge replaces caching entirely since compressed files never need revalidation.
Compressing at the edge encrypts traffic so the origin never needs to serve TLS to clients.
How does the transition from HTTP/2 to HTTP/3 (QUIC) at the CDN layer impact performance for users on high-latency mobile networks?
Select the correct answer
QUIC drops encryption to save round-trips, which speeds up handshakes for users switching between mobile cells
QUIC runs over TCP with larger windows, so it lowers latency only on stable wired connections, not mobile
QUIC removes TCP head-of-line blocking and supports connection migration, improving lossy mobile performance
QUIC multiplexes streams over one TCP socket, so a single packet loss still stalls every concurrent stream
What is TLS session resumption, and how does the CDN reuse TLS sessions at the edge to reduce handshake overhead?
Select the correct answer
It lets the CDN cache HTTP responses so repeated requests skip contacting the origin server fully.
It compresses the certificate chain so each new handshake transfers fewer bytes to the client.
It rotates session keys on every request to strengthen forward secrecy during the handshake.
It lets clients resume prior sessions with cached keys, avoiding a full handshake's extra round trips.
What is 'Edge Compute' (e.g., Workers/Functions-at-the-Edge), and how does it change the traditional 'static' nature of a CDN?
Select the correct answer
It caches database queries at the edge so origins no longer process any dynamic requests at all.
It compresses static assets automatically at every edge so dynamic content is never required again.
It moves the entire backend server into each edge node, replicating databases globally for writes.
It runs custom code on edge nodes, letting CDNs handle dynamic logic instead of only static files.
What is 'Edge Compute' (or Edge Functions) and what logic is appropriate to move from the backend to the edge?
Select the correct answer
Stateful session management requiring strong consistency and frequent writes to shared storage.
Heavy database joins and long transactions that need consistent access to a central data store.
Large batch jobs and analytics pipelines that process gigabytes of data over many long minutes.
Lightweight stateless tasks like auth, redirects, and header rewrites that benefit from low latency.
When would you use an Edge Function to modify a request/response instead of doing it at the origin?
Select the correct answer
When changes require complex queries against the primary database before responding to the client.
When changes must run only once globally and stay strongly consistent across every region instantly.
When changes need low latency near users and don't require origin data, like redirects or headers.
When changes involve large file processing and long-running computation tied to backend resources.
When would you use an 'Edge Function' versus a traditional serverless function?
Select the correct answer
Edge functions support longer execution and larger memory; serverless is limited to short bursts only.
Edge functions are stateful and cached; serverless functions are stateless and never reused at all here.
Edge functions always access databases faster; serverless cannot connect to any persistent data store.
Edge functions run globally near users with tight limits; serverless runs regionally with more resources.
What are the tradeoffs of moving logic to 'Edge Functions' (Compute-at-the-Edge) vs. keeping it in the backend?
Select the correct answer
Edge lowers latency and offloads origin but limits runtime, resources, and access to central data.
Edge removes all latency and resource limits while giving full access to the central database always.
Edge eliminates the backend entirely so no origin server or central data store is ever needed again.
Edge increases latency but simplifies deployment by keeping all the state in one centralized region.
Why would a company adopt a 'Multi-CDN' strategy? What are the architectural complexities of doing so?
Select the correct answer
Lowers cost by always routing to the cheapest provider, but needs unified billing across all the vendors
Improves resilience and performance via provider redundancy, but needs complex cross-CDN traffic steering
Removes the origin server entirely from the stack, but needs apps rewritten to run fully serverless
Ensures zero downtime by caching all content forever, but needs manual cache purging on each provider