Backend interview prep

Start

CDN Interview Questions (Top 15 Questions with Answers)

Master CDN Interview Questions with production-ready explanations covering edge locations, origin servers, caching, cache keys, TTL, invalidation, signed URLs, TLS, DDoS protection, dynamic content acceleration, troubleshooting, cost optimization, and enterprise CDN architecture.

Module Navigation

Previous: DNS QA | Parent: Networking Learning Path | Next: Hybrid Networking QA

Introduction

A Content Delivery Network, or CDN, is a globally distributed network of edge servers that delivers content from locations closer to users.

Without a CDN, every request travels to the origin server.

User in Asia
      │
      ▼
Origin Server in USA
      │
      ▼
Response

This may cause:

  • High latency
  • Slow page loads
  • Increased origin traffic
  • Poor global performance
  • Higher bandwidth usage
  • Greater outage impact

With a CDN:

User
  │
  ▼
Nearby Edge Location
  │
  ├── Cache Hit → Return Content
  │
  └── Cache Miss → Fetch from Origin

A CDN can deliver:

  • Images
  • CSS
  • JavaScript
  • Videos
  • Documents
  • Software downloads
  • API responses
  • Dynamic web content

Major cloud CDN services include:

Cloud Provider CDN Service
AWS Amazon CloudFront
Azure Azure Front Door and Azure CDN
Google Cloud Cloud CDN

This guide contains 15 production-focused CDN interview questions covering CDN fundamentals, edge caching, origin servers, cache keys, TTL, invalidation, signed URLs, dynamic content, security, cost, troubleshooting, and enterprise architecture.

Learning Roadmap

CDN Fundamentals
       │
       ▼
Edge Locations
       │
       ▼
Origin Servers
       │
       ▼
Caching
       │
       ▼
Cache Keys and TTL
       │
       ▼
Invalidation
       │
       ▼
Security
       │
       ▼
Enterprise CDN Design

CDN Fundamentals

1. What is a CDN?

A CDN is a distributed network of servers that caches and delivers content from locations geographically closer to users.

Architecture:

Global Users
      │
      ▼
CDN Edge Locations
      │
      ▼
Origin Server

Benefits:

  • Lower latency
  • Faster page loads
  • Reduced origin traffic
  • Better scalability
  • Higher availability
  • Global performance
  • DDoS resilience

A CDN improves both performance and reliability.

2. Why is a CDN important for cloud applications?

Cloud applications often serve users from multiple countries and regions.

Without a CDN:

All Users
    │
    ▼
One Origin Region

Problems:

  • Long network distance
  • Increased latency
  • Origin overload
  • Higher bandwidth consumption
  • Reduced resilience

With a CDN:

Users in USA    → USA Edge

Users in Europe → Europe Edge

Users in Asia   → Asia Edge

The CDN reduces the distance between users and content.

CDN Architecture

3. What is an edge location?

An edge location is a CDN point of presence close to end users.

It receives requests and may serve cached content.

User
  │
  ▼
Edge Location
  │
  ├── Cached Content Available
  │       │
  │       ▼
  │    Return Content
  │
  └── Not Cached
          │
          ▼
       Origin Server

Edge locations improve:

  • Latency
  • Throughput
  • Availability
  • User experience

They are different from cloud regions because they are primarily optimized for content delivery.

4. What is an origin server?

The origin server is the authoritative source of content.

Possible origins include:

  • Object storage
  • Web server
  • Application Load Balancer
  • API Gateway
  • Kubernetes ingress
  • On-premises server
  • Another CDN
  • Media server

Architecture:

CDN
 │
 ▼
Origin Server
 │
 ▼
Original Content

The CDN retrieves content from the origin when the requested object is not available at the edge.

Caching

5. How does CDN caching work?

When a user requests content, the CDN checks whether the object exists in the edge cache.

Cache hit

User Request
      │
      ▼
Edge Cache
      │
      ▼
Object Found
      │
      ▼
Return Immediately

Cache miss

User Request
      │
      ▼
Edge Cache
      │
      ▼
Object Missing
      │
      ▼
Fetch from Origin
      │
      ▼
Store at Edge
      │
      ▼
Return to User

Caching reduces repeated origin requests.

6. What is the difference between a cache hit and a cache miss?

Cache Hit Cache Miss
Object found at the edge Object not found at the edge
Faster response Requires origin request
Lower origin load Higher origin load
Lower latency Higher latency
Lower bandwidth usage More origin bandwidth

A high cache-hit ratio generally indicates efficient caching.

However, a high cache-hit ratio should not come at the cost of serving stale or incorrect content.

Cache Keys and TTL

7. What is a cache key?

A cache key determines whether two requests should use the same cached object.

A cache key may include:

  • URL path
  • Query parameters
  • HTTP headers
  • Cookies
  • Hostname
  • HTTP method

Example:

/products?id=100

and:

/products?id=200

If the query parameter is part of the cache key, these become separate cached objects.

Poor cache-key design can cause:

  • Low cache-hit ratio
  • Incorrect content reuse
  • Excessive cache entries
  • Data leakage
  • Higher cost

Best practice:

Include Only Values That Change the Response

8. What is TTL in a CDN?

TTL stands for Time to Live.

TTL determines how long an object remains cached before the CDN checks the origin again.

Example:

Cache-Control:

max-age=3600

This allows caching for one hour.

Short TTL

Advantages:

  • Fresher content
  • Faster content updates

Disadvantages:

  • More origin traffic
  • Lower cache-hit ratio

Long TTL

Advantages:

  • Better performance
  • Lower origin load
  • Higher cache-hit ratio

Disadvantages:

  • Greater risk of stale content
  • Slower update visibility

Recommended approach:

  • Long TTL for versioned static files
  • Short TTL for frequently changing content
  • No caching for sensitive personalized responses unless specifically designed

Cache Control

9. How do HTTP cache headers control CDN behavior?

Common cache headers include:

Cache-Control

Example:

Cache-Control: public, max-age=3600

Expires

Specifies an absolute expiration time.

ETag

Identifies a specific version of content.

Last-Modified

Indicates when content was last changed.

Example validation flow:

CDN Cache Expired
       │
       ▼
Send If-None-Match
       │
       ▼
Origin Compares ETag
       │
 ┌─────┴─────────┐
 ▼               ▼
Unchanged       Changed
 │               │
 ▼               ▼
304 Response   New Content

Headers should clearly define whether content is:

  • Publicly cacheable
  • Private
  • Non-cacheable
  • Revalidatable
  • Time limited

10. What is cache invalidation?

Cache invalidation removes content from CDN edge caches before its TTL expires.

Example:

Old JavaScript File Cached

↓

Production Bug Fixed

↓

Invalidate Cached File

↓

Edge Fetches New Version

Invalidation may be required for:

  • Urgent content changes
  • Security fixes
  • Incorrect content
  • Product or pricing updates
  • Application releases

Challenges:

  • It may take time to propagate
  • It may increase origin traffic
  • Some providers charge for high invalidation volume
  • Broad invalidations can reduce cache efficiency

Preferred strategy for static assets:

app.v1.js

↓

app.v2.js

This is called cache busting or versioned asset naming.

Static and Dynamic Content

11. Can a CDN accelerate dynamic content?

Yes.

A CDN can accelerate dynamic content even when the response is not fully cached.

Techniques include:

  • Global edge routing
  • Persistent connections
  • TLS connection reuse
  • Optimized network paths
  • Connection pooling
  • Request compression
  • API acceleration
  • Origin shielding

Architecture:

User
  │
  ▼
Nearby CDN Edge
  │
  ▼
Optimized Backbone
  │
  ▼
Dynamic Origin

Dynamic responses should be cached only when safe.

Examples that may require caution:

  • User dashboards
  • Banking details
  • Shopping carts
  • Authentication responses
  • Personalized APIs

Security

12. How does a CDN improve security?

A CDN can provide several security capabilities:

  • TLS termination
  • Web Application Firewall integration
  • DDoS protection
  • Bot management
  • Rate limiting
  • Geographic restrictions
  • Signed URLs
  • Signed cookies
  • Origin protection
  • Request filtering

Secure architecture:

Internet User
      │
      ▼
CDN
      │
      ▼
WAF
      │
      ▼
Origin

The origin should ideally accept requests only from the CDN or approved network paths.

This prevents attackers from bypassing CDN security controls.

13. What are signed URLs and signed cookies?

Signed URLs and signed cookies restrict access to private CDN content.

Signed URL

A URL contains a signature and expiration time.

https://cdn.example.com/video.mp4
?expires=...
&signature=...

Use cases:

  • Private downloads
  • Training videos
  • Paid media
  • Financial statements
  • Temporary file sharing

A browser receives a cookie that allows access to multiple protected objects.

Use cases:

  • Access to an entire private media section
  • Multiple files under one path
  • Session-based protected content

Benefits:

  • Time-limited access
  • Controlled distribution
  • Reduced direct origin exposure

Multi-Cloud and Operations

14. How do AWS, Azure, and Google Cloud CDN services compare?

Capability AWS Azure Google Cloud
CDN Service CloudFront Front Door / Azure CDN Cloud CDN
Edge Delivery Yes Yes Yes
TLS Yes Yes Yes
WAF Integration AWS WAF Azure WAF Cloud Armor
Object Storage Origin S3 Blob Storage Cloud Storage
Dynamic Acceleration Yes Yes Yes
Signed Access Signed URLs/Cookies Token-based options Signed URLs/Cookies

All major cloud CDNs provide:

  • Global edge delivery
  • TLS
  • Caching
  • Origin integration
  • Security integration
  • Logging
  • Performance monitoring

Architecture and feature names vary by provider.

Enterprise Design

15. How would you design an enterprise CDN architecture?

A production CDN architecture should optimize global performance while protecting the origin and preventing incorrect caching.

Global Users
      │
      ▼
Global DNS
      │
      ▼
CDN Edge Network
      │
      ▼
Web Application Firewall
      │
      ▼
Origin Shield
      │
      ▼
Public Load Balancer
      │
      ▼
Application Cluster
      │
      ▼
Databases and Storage

Static-content path:

User
  │
  ▼
CDN
  │
  ▼
Object Storage Origin

Dynamic-content path:

User
  │
  ▼
CDN
  │
  ▼
WAF
  │
  ▼
API Load Balancer
  │
  ▼
Application

Recommended controls:

  • Version static assets
  • Define explicit cache policies
  • Protect the origin
  • Enable TLS
  • Use WAF and DDoS protection
  • Avoid caching sensitive responses
  • Configure origin timeouts
  • Enable access logging
  • Monitor cache-hit ratio
  • Monitor origin latency
  • Use signed access for private content
  • Test invalidation procedures
  • Configure multi-origin failover
  • Apply least-privilege origin access
  • Review CDN cost and traffic patterns

Production Scenario

Enterprise Banking Platform

Requirements:

  • Global mobile and web users
  • Static web content
  • Public product information
  • Private banking documents
  • Secure API traffic
  • DDoS protection
  • Multi-region failover
  • No caching of personalized account data

Architecture:

Global Users
      │
      ▼
Global DNS
      │
      ▼
CDN
      │
      ▼
WAF and DDoS Protection
      │
 ┌────┴─────────────────┐
 ▼                      ▼
Static Content          API Traffic
 │                      │
 ▼                      ▼
Object Storage       Load Balancer
                        │
                        ▼
                 Spring Boot Services

Private document access:

Authenticated User
        │
        ▼
Application Authorizes Request
        │
        ▼
Generate Signed URL
        │
        ▼
CDN Delivers Document

Caching policy:

Content Caching Strategy
CSS and JavaScript Long TTL with versioned filenames
Images Long TTL
Public product pages Moderate TTL
Exchange rates Short TTL
User account data Do not cache publicly
Bank statements Signed, private access

Benefits:

  • Faster global access
  • Reduced origin load
  • Secure document distribution
  • Better DDoS resilience
  • Multi-region availability

CDN Request Flow

User Request
      │
      ▼
Nearest Edge
      │
      ▼
Cache Lookup
      │
 ┌────┴─────────┐
 ▼              ▼
Cache Hit     Cache Miss
 │              │
 ▼              ▼
Return       Fetch Origin
Content          │
                 ▼
             Cache Object
                 │
                 ▼
             Return Content

Cache-Key Flow

Request
  │
  ▼
URL Path
Query Parameters
Headers
Cookies
  │
  ▼
Build Cache Key
  │
  ▼
Search Edge Cache

Invalidation Flow

Content Updated
      │
      ▼
Old Object Still Cached
      │
      ▼
Invalidate or Change Filename
      │
      ▼
Edge Fetches New Content

Secure Private Content Flow

User Authenticates
       │
       ▼
Application Authorizes
       │
       ▼
Signed URL or Cookie
       │
       ▼
CDN Validates Signature
       │
       ▼
Private Content Returned

Multi-Origin Failover

CDN
 │
 ▼
Primary Origin Healthy?
 │
 ├── Yes → Primary Origin
 │
 └── No  → Secondary Origin

CDN Troubleshooting Flow

Slow or Incorrect Response
          │
          ▼
Check DNS Resolution
          │
          ▼
Check CDN Response Headers
          │
          ▼
Determine Hit or Miss
          │
          ▼
Review Cache Key
          │
          ▼
Review Cache-Control Headers
          │
          ▼
Check Origin Health
          │
          ▼
Check WAF and TLS
          │
          ▼
Review CDN Logs

Common indicators:

Cache Hit

Cache Miss

Expired

Bypass

Error

Provider-specific response headers may indicate whether the response came from cache or origin.

Common CDN Mistakes

✗ Caching personalized user data publicly
✗ Including every cookie in the cache key
✗ Including unnecessary headers in the cache key
✗ Ignoring query-string behavior
✗ Setting one TTL for every content type
✗ Using frequent broad invalidations
✗ Not versioning static assets
✗ Leaving the origin publicly accessible
✗ Not enabling TLS
✗ Missing WAF protection
✗ Caching error responses too long
✗ Not forwarding required authorization headers
✗ Ignoring CDN access logs
✗ Not monitoring cache-hit ratio
✗ Assuming all dynamic content is uncacheable

Best Practices Checklist

✓ Use CDN for Global Content Delivery
✓ Cache Static Assets Aggressively
✓ Version Static Filenames
✓ Define Explicit Cache Policies
✓ Keep Cache Keys Minimal
✓ Include Only Required Query Parameters
✓ Include Only Required Headers and Cookies
✓ Use Appropriate TTLs
✓ Avoid Public Caching of Sensitive Data
✓ Protect Origins from Direct Access
✓ Enable TLS
✓ Integrate WAF and DDoS Protection
✓ Use Signed URLs or Cookies for Private Content
✓ Enable Compression
✓ Monitor Cache-Hit Ratio
✓ Monitor Origin Latency
✓ Configure Origin Timeouts
✓ Enable Access Logging
✓ Test Cache Invalidation
✓ Design Multi-Origin Failover

Quick Revision

Topic Key Point
CDN Global content-delivery network
Edge Location Server close to users
Origin Authoritative source of content
Cache Hit Content served from edge
Cache Miss Content fetched from origin
Cache Key Identifies a cached object
TTL Cache duration
Cache-Control HTTP caching instructions
ETag Content-version identifier
Invalidation Removes cached content early
Cache Busting Uses versioned URLs or filenames
Dynamic Acceleration Speeds non-cached requests
Signed URL Temporary access to private content
Origin Shield Reduces repeated origin requests
Best Practice Secure, minimal-key, versioned, monitored caching

Interview Follow-Up Questions

Interviewers may ask:

  1. What is the difference between a CDN edge location and a cloud region?
  2. What happens during a cache miss?
  3. How is cache-hit ratio calculated?
  4. What should be included in a cache key?
  5. Why can cookies reduce cache efficiency?
  6. How does TTL affect content freshness?
  7. What is the difference between invalidation and cache busting?
  8. How do ETags support cache validation?
  9. Can APIs be cached?
  10. How do you prevent sensitive data from being cached?
  11. What is origin shielding?
  12. How does a CDN support DDoS protection?
  13. What is the difference between signed URLs and signed cookies?
  14. How do you troubleshoot stale CDN content?
  15. How would you design CDN failover across regions?

Interview Tips

During CDN interviews:

  • Define a CDN as a globally distributed edge network that reduces latency and origin load.
  • Explain cache hits, cache misses, origins, edge locations, cache keys, and TTL.
  • Describe how Cache-Control, ETag, and Last-Modified affect caching behavior.
  • Explain why cache-key design directly affects performance, cost, and correctness.
  • Recommend versioned filenames instead of frequent invalidations for static assets.
  • Discuss dynamic acceleration in addition to static caching.
  • Explain how signed URLs and signed cookies protect private content.
  • Emphasize that user-specific and sensitive data must not be publicly cached.
  • Include TLS, WAF, DDoS protection, logging, origin restriction, and multi-origin failover in enterprise designs.
  • Mention cache-hit ratio, origin latency, error rate, and bandwidth reduction as important CDN metrics.

Summary

A CDN improves application performance, availability, scalability, and security by delivering content through globally distributed edge locations.

Key concepts include:

  • CDN Fundamentals
  • Edge Locations
  • Origin Servers
  • Cache Hits and Misses
  • Cache Keys
  • TTL
  • Cache-Control Headers
  • ETags
  • Cache Invalidation
  • Cache Busting
  • Dynamic Content Acceleration
  • TLS
  • WAF and DDoS Protection
  • Signed URLs and Cookies
  • Enterprise CDN Architecture

Mastering these 15 CDN interview questions prepares you for Cloud Engineer, Network Engineer, DevOps Engineer, Site Reliability Engineer, Platform Engineer, Cloud Security Engineer, Performance Engineer, Technical Lead, Solution Architect, and Enterprise Architect interviews.