AWS Cloudfront

Question 1

AWS CloudFront

Answer 1

Content Delivery Network, improves read performance, content cached at edge locations

Question 2

What is the difference between CloudFront and S3 Cross Region Replication?

Answer 2

Cloudfront is good for static content that must be available everywhere, S3 Cross Region Replication is good for dynamic content that needs to be available at low latency in a few regions (must be setup for each region)

Question 3

CloudFront Cache Key

Answer 3

Unique identifier for every object in the cache

Question 4

Cache Policy

Answer 4

Cache can be based on:
- HTTP headers
- Cookies
- Query strings

Question 5

True or false? All HTTP headers, cookies, and query strings that you include in the Cache Key are automatically included in origin requests

Answer 5

True

Question 6

Origin Request Policy

Answer 6

Specify values you want to include in origin requests without including them in the Cache Key

Question 7

CloudFront Cache Invalidation

Answer 7

Force and entire or partial cache refresh (bypassing TTL), can invalidate all files (*) or a special path eg. add new images to S3 bucket and want it to be seen immediately

Question 8

VPC Origins

Answer 8

Allows you to deliver content from applications in VPC private subnets e.g ALB, NLB, EC2

Question 9

CloudFront Geo Restriction

Answer 9

Restrict who can access your distribution via allow list / block list

Question 10

CloudFront Signed URL

Answer 10

Allow access to a path no matter the origin, leverage caching features

Question 11

CloudFront Signed URL process

Answer 11

Create trusted key group, private key is used by applications to sign URLs, public key used by CloudFront to verify URLs

Question 12

True or false? Cost of data out is different for different edge locations?

Answer 12

true, eg. India is more expensive than US

Question 13

CloudFront multiple origin

Answer 13

Route to different origins based on content type eg. api goes to ALB, others go to S3 bucket

Question 14

CloudFront Origin groups

Answer 14

one primary and one secondary origin - if primary origin fails, second one is used

Question 15

Field level encryption

Answer 15

Adds additional security along with HTTPS, data encrypted at edge location with public key and decrypted using private key at web server

Question 16

CloudFront real time logs

Answer 16

Logs sent to Kinesis Data Streams for monitoring and analysis