CloudFront + API performance

15 timed scenario questions (~24 min, ~96 sec each). Reinforces night-26-cloudfront-api-caching.md and night-26-lab-cloudfront-setup scripts. Answer without peeking at night-26-quiz-answers.json first.

1. 1.globalskiatlas.com serves static HTML from S3 and wiki JSON from API Gateway behind one CloudFront distribution. GET /api/wiki/pages should reach Lambda on every request until you design explicit edge caching. Which cache policy on the api/wiki* behavior is the safe starting point?

   A.CachingDisabled — dynamic API responses must not be edge-cached by defaultB.CachingOptimized — reuse the default S3 behavior for every API path patternC.Elemental-MediaPackage — optimized for HLS video segments served at the edgeD.UseOriginCacheControl — skip attaching any managed cache policy object at all

2. 2.After enabling a permissive CloudFront cache policy on GET /api/iceberg-stats, the second identical request still shows X-Cache: Miss. Lambda returns JSON without Cache-Control or Expires. What is the most likely fix?

   A.Add Route 53 latency routing so viewers always hit the closest us-east-1 edge POPB.Have the origin return Cache-Control (e.g. public, max-age=60) so CloudFront may store itC.Enable API Gateway stage caching — claim CloudFront cannot cache any API responsesD.Switch the behavior to target S3 instead of API Gateway for all JSON API paths

3. 3.A partner mobile app must be limited to 1,000 requests per day with burst protection, using a key you issue per partner. Which API Gateway feature primary enforces per-client limits?

   A.AWS WAF rate-based rule on the CloudFront distribution onlyB.Lambda reserved concurrency set to 1,000 on the integration functionC.Usage plan with API key — throttle and quota applied per issued keyD.CloudFront Origin Shield placed in the API Gateway Region

4. 4.Night 23 placed Redis in front of Aurora for resort_stats rows inside the VPC. Night 26 discusses CloudFront in front of /api/*. How do the two caches differ?

   A.They are interchangeable — disable Redis whenever CloudFront caching is enabledB.ElastiCache replaces CloudFront for static S3 assets at a lower monthly costC.CloudFront only caches S3 objects; API Gateway responses always bypass the CDND.CloudFront caches HTTP at the edge; ElastiCache caches app objects near compute

5. 5.Wiki POST /api/wiki/pages requires a Cognito JWT. GET /api/wiki/pages is anonymous. You consider edge-caching GET responses. Which cache-key design avoids serving one user's draft to another?

   A.Cache only anonymous GETs — omit Authorization or cache a public subsetB.Include Authorization in the cache key and set TTL to 24 hours for all usersC.Use weighted Route 53 routing between cached and uncached behaviorsD.Enable POST in CachedMethods so CloudFront invalidates on every write

6. 6.Traffic to your REST API stage exceeds the configured steady-state rate but stays within burst capacity for a few seconds. What HTTP status do clients typically receive when limits are exceeded?

   A.503 Service Unavailable returned from a CloudFront custom error response pageB.429 Too Many Requests — API Gateway throttle limit has been reachedC.403 Forbidden — IAM explicitly denies the execute-api:Invoke API callD.502 Bad Gateway — Lambda integration timed out on every throttled request

7. 7.Your CloudFront distribution has behaviors: default * → S3, api/wiki* → Wiki API, api/iceberg-stats → stats API. A request arrives for GET /api/iceberg-stats. Which behavior matches?

   A.Default * — CloudFront always prefers the longest wildcard pathB.Random weighted choice between the two configured API behaviorsC.Most specific path pattern — api/iceberg-stats before api/wiki*D.Default * because iceberg-stats is not nested under api/wiki*

8. 8.Frequently updated JSON at /api/iceberg-stats should not require paid invalidations on every deploy. What is the exam-favored approach?

   A.Disable compression on the cache behavior to force revalidation each timeB.Create a new CloudFront distribution per deploy for zero stale edge dataC.Use S3 Cross-Region Replication on the API Gateway deployment stageD.Short TTL or origin Cache-Control max-age — let entries expire naturally

9. 9.An exam scenario asks where to view CacheHitRate for a CloudFront distribution serving globalskiatlas.com. Which namespace and Region combination is correct?

   A.AWS/CloudFront in us-east-1 with DistributionId and Region=GlobalB.AWS/ApiGateway in every edge POP Region tracked separatelyC.AWS/Lambda in us-east-1 only — CloudFront publishes no metricsD.AWS/S3 in the bucket Region — CacheHitRate is an S3 storage metric

10. 10.Which HTTP methods can CloudFront cache at the edge when listed in CachedMethods for an API behavior?

    A.All seven methods if the origin returns HTTP 200 for the requestB.GET and HEAD only among cacheable methods — not POST/PUT/DELETEC.POST only — GET always goes to origin for API Gateway backendsD.OPTIONS and PATCH — required for CORS preflight response caching

11. 11.Account-wide API traffic spikes across many APIs in us-east-1. Some stages have not set custom throttle limits. What still caps total invoke rate?

    A.Per-distribution CloudFront OriginLatency alarm thresholdsB.DynamoDB on-demand capacity units for every API integrationC.API Gateway account-level throttle limits that apply Region-wideD.Route 53 health-check failure thresholds on the API custom domain

12. 12.You need to protect a regional ALB from HTTP floods. WAF is already on CloudFront for the public site. Where do you attach a REGIONAL-scoped Web ACL for the ALB?

    A.Any Region — WAF ACLs are treated as global resources for every AWS serviceB.eu-west-1 — closest edge POP Region to European viewer traffic for the ALBC.CloudFront edge only — Application Load Balancers cannot attach WAF Web ACLsD.Same Region as the ALB — REGIONAL scope, unlike CloudFront WAF in us-east-1

13. 13.Lambda behind API Gateway averages 800 ms; clients report slow TTFB on cache misses. CloudFront OriginLatency metric is high. First performance step before adding ElastiCache?

    A.Optimize Lambda duration and cache cacheable GETs at CloudFront when safeB.Enable Multi-AZ configuration on the API Gateway REST API stage settingsC.Increase edge TTL to 86400 seconds on all wiki paths including mutating POSTD.Replace the HTTP API with S3 website hosting for every JSON API payload path

14. 14.Exam contrast: API Gateway REST API stage cache vs CloudFront cache behavior for the same GET endpoint exposed via CloudFront → API GW → Lambda.

    A.They are the same service — enable only one cache layer at a timeB.Stage cache is Regional at API Gateway; CloudFront cache is at edge POPsC.CloudFront stage cache requires Redis running inside the application VPCD.API Gateway cache only works when the integration target is DynamoDB

15. 15.A viral article causes millions of identical GET /api/wiki/pages requests worldwide. DynamoDB read capacity is spiking. Which layered approach best cuts database reads?

    A.Disable CloudFront entirely — send all traffic directly to the API Gateway DNS nameB.Usage plan with zero quota — block all readers until the worldwide traffic spike endsC.CloudFront edge cache on anonymous GET plus origin Cache-Control; ElastiCache optional deeperD.Athena SQL over a wiki DynamoDB export — replace live reads for the duration of the spike