CDN Interview & Revision

A globally distributed network of edge servers (PoPs) that caches content close to users to reduce latency, offload origin traffic, and commonly provide TLS termination, DDoS absorption, and other edge protections.

A cache hit means the requested object is already cached at the edge and is served directly. A cache miss means the edge doesn't have it (or it expired), so it must fetch it from the origin, cache it, then serve it.

TTL is the duration a cached object is considered fresh, typically set via Cache-Control max-age. Once it expires, the object is stale; the next request triggers a fresh fetch (or a conditional revalidation) from the origin.

Trigger a cache invalidation (purge) by URL, by tag/surrogate key, or by wildcard pattern — bypassing the TTL entirely.

Via DNS-based routing or anycast: GeoDNS returns different answers by resolver region, while anycast advertises the same IP from many PoPs so internet routing picks a nearby healthy location.

A CDN caches content at globally distributed edge locations to reduce latency and offload the origin; a load balancer distributes requests across a specific pool of backend servers, typically near the origin. They usually coexist rather than replace one another — see Load Balancer fundamentals for the backend-distribution layer.

By serving the vast majority of repeat requests from edge caches, so only the first request (or a small trickle of cache misses) ever reaches the origin — turning a potential origin overload into a non-event.

Long-TTL versioned URLs for static assets (images, JS, CSS); short micro-cache or no caching for personalized/checkout content marked private/no-store; origin shielding to absorb cache-miss thundering herds; edge WAF and TLS termination for security; automated purge as part of the deploy pipeline for CMS-driven pages.

Why doesn't a lower TTL always mean 'better' — what's the trade-off? Answer: A lower TTL gives fresher content but means more revalidations and origin fetches and a lower hit ratio. The right TTL is per asset: versioned files can live for a year, while a semi-dynamic page may need seconds.

What's the difference between no-cache and no-store, and why is the naming misleading? Answer: no-cache lets a cache store the response but requires revalidation before every reuse; no-store forbids storing it at all. The name sounds like no-store, which is why it misleads.

Why is anycast-based failover faster than GeoDNS-based failover? Answer: Anycast failover is a routing change (a PoP stops announcing the IP and BGP reroutes), so it avoids DNS caching delays, though it still depends on BGP convergence. GeoDNS failover waits for cached DNS answers to expire.

What is origin shielding, and what specific problem does it solve? Answer: A designated shield tier between the edge PoPs and the origin. It consolidates misses so a newly popular or cold object is fetched from the origin once rather than once per PoP, preventing a thundering herd.

Why can a request header or cookie that changes the response but is missing from the cache key (and from Vary) cause a serious security bug rather than just a performance issue? Answer: The cache stores the response under a key that does not include that input, so one user's personalised response can be served to others — a data leak or cache poisoning. An input that is in the key or Vary only costs hit ratio.

Name one scenario where you'd prefer versioned URLs over cache invalidation, and one where you'd prefer invalidation. Answer: Versioned URLs: hashed JS/CSS build artefacts, where a new deploy is a new key. Invalidation: a CMS-driven HTML page or a JSON config at a fixed URL that must update now.