Examkin

Question

Difficulty: HardAmazon CloudFront Caching, Origins, and Security

A SysOps administrator is troubleshooting a low cache hit ratio on an Amazon CloudFront distribution that serves a dynamic API. The application origin, hosted on EC2 instances behind an Application Load Balancer (ALB), requires the custom 'country-code' query string to return localized content, and the 'Authorization' header to authenticate each client request. Currently, the distribution's cache behavior is configured to forward all headers and query strings to the origin. Which configuration will maximize the cache hit ratio at the edge locations while ensuring the application still functions correctly?

  1. Create a custom Cache Policy that includes only the 'country-code' query string parameter in the cache key, and does not include the 'Authorization' header. Create a custom Origin Request Policy that forwards the 'Authorization' header to the origin, and associate both policies with the default cache behavior.Answer
  2. B
    Create a CNAME record at the zone apex in Amazon Route 53 pointing to the CloudFront distribution domain name, and configure a custom Cache Policy that includes both the 'country-code' query string and the 'Authorization' header in the cache key.
  3. C
    Configure Route 53 active-passive DNS failover routing to point to the ALB and a backup static origin, and configure the Cache Policy to include the 'Authorization' header while disabling query string caching.
  4. D
    Create a custom Cache Policy that excludes the 'Authorization' header from the cache key, and update the stateless network access control list (NACL) of the ALB subnets to deny outbound ephemeral port ranges (1024-65535) to protect the authorization tokens.

Answer

Create a custom Cache Policy that includes only the 'country-code' query string parameter in the cache key, and does not include the 'Authorization' header. Create a custom Origin Request Policy that forwards the 'Authorization' header to the origin, and associate both policies with the default cache behavior.
The correct answer provides the optimal configuration by using a Cache Policy to define the cache key based only on the localized query string parameter, thereby keeping the cache hit ratio high. Simultaneously, the Origin Request Policy ensures that the authorization header is passed to the origin so that authentication checks succeed.

Step-by-Step Solution

1
Analyze cache behavior settings and separate caching keys from origin forwarding requirements.
Identify that the 'country-code' query string is required for caching variations, while the unique 'Authorization' header is only required by the origin server for validation.
Including unique headers like 'Authorization' in the cache key causes a low cache hit ratio because each client's request results in a unique cache key.
2
Create a custom Cache Policy in CloudFront.
Configure the Cache Policy to include 'country-code' as a query string cache key dependency and exclude the 'Authorization' header from the cache key settings.
This ensures CloudFront edge servers cache and serve common localized pages based on the country, maximizing cache hit rates.
3
Create a custom Origin Request Policy in CloudFront.
Configure the Origin Request Policy to forward the 'Authorization' header to the origin, while leaving it out of the cache key.
This allows the origin ALB and EC2 instances to receive the necessary credentials to authenticate the client requests.
4
Associate both policies with the distribution's cache behavior.
Apply the new Cache Policy and Origin Request Policy to the default cache behavior of the distribution.
This binds the new forwarding and caching logic to incoming client requests.

Key Concept

CloudFront Cache Policies determine what is cached (cache key), while Origin Request Policies determine what is sent to the origin. Separating these concerns allows forwarding credentials without destroying cache efficiency.
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic