CloudFront and Global Accelerator: SOA-C03 study notes and practice questions
What to know about CloudFront and Global Accelerator for the SOA-C03 exam, from the Networking and Content Delivery domain (18% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.
Content delivery questions ask how to make delivery faster, cheaper or more secure, or why CloudFront serves stale or wrong content.
CloudFront configuration
Origins: S3 (private, with origin access control), ALB, API Gateway, custom HTTP servers; origin groups fail over to a secondary origin on errors.
Cache behaviors per path pattern, each with a cache policy (what’s in the cache key and TTLs) and an origin request policy (what’s forwarded to the origin).
Viewer protocol policy: redirect HTTP to HTTPS; certificates from ACM in us-east-1.
Signed URLs and signed cookies restrict private content; geographic restrictions allow or block countries.
CloudFront Functions (lightweight header and URL changes) and Lambda@Edge (heavier logic).
A solar installer's marketing site uses Amazon CloudFront in front of an Application Load Balancer.
Since a new ad campaign started, the cache hit ratio has fallen from 90 percent to 15 percent and origin load has risen. Every campaign link adds unique utm_source and click-ID query strings.
The site's pages vary only by the lang query string. The distribution's cache policy currently includes all query strings in the cache key.
What should a CloudOps engineer do?
Choose one answer.
AA. Create an invalidation for /* every hour so that the caches are refreshed with the latest version of each page.
BB. Raise the minimum TTL in the cache policy to one day so that cached pages stay in the edge caches longer.
CC. Turn on Origin Shield so that the misses caused by the campaign links are answered from the central caching layer.
DD. Change the cache policy to include only the lang query string in the cache key.
D. Right: Correct. Values in the cache key create separate cached objects, so unique tracking parameters make almost every request a miss. Including only lang lets all campaign visitors share cached pages. Learn more: Understand cache policies (opens in a new tab)
Explanation
CloudFront caches one object per unique cache key. Query strings, headers and cookies in the cache key multiply the objects, and unique tracking parameters make every request different. Including only the values that change the response, here lang, restores the hit ratio. If the origin still needs other parameters, an origin request policy can forward them without adding them to the cache key.
An esports league hosts real-time match servers that use UDP in us-west-2 and eu-central-1 behind Network Load Balancers.
Players around the world connect through a game client that can store only two fixed IP addresses.
The league wants players to enter the AWS network near them for lower jitter, and traffic to move to the other Region within seconds if one Region's servers become unhealthy.
What should a CloudOps engineer use?
Choose one answer.
AA. An Amazon CloudFront distribution with both Network Load Balancers in an origin group.
BB. An AWS Global Accelerator accelerator with an endpoint group for each Region that contains that Region's Network Load Balancer.
CC. Route 53 latency-based records for the two load balancers, with health checks on each record.
DD. Elastic IP addresses on each Network Load Balancer, with the client switching to the other Region when it detects a failure.
Show the answer and explanation
Answer: B
A. Wrong: CloudFront serves HTTP and HTTPS, including WebSocket, but it does not carry arbitrary UDP game traffic. Origin groups also fail over per request for HTTP responses only. Learn more: What is Amazon CloudFront? (opens in a new tab)
B. Right: Correct. Global Accelerator gives two static anycast IP addresses that players enter at the nearest edge location, and it supports UDP. Its health checks move traffic to the healthy endpoint group quickly, without DNS changes. Learn more: What is AWS Global Accelerator? (opens in a new tab)
Global Accelerator suits non-HTTP traffic such as UDP games that needs fixed IP addresses and fast Regional failover. Its two static anycast addresses bring players onto the AWS network close to them, and health-based routing shifts traffic between endpoint groups without waiting for DNS caches. CloudFront is for HTTP content, and DNS-based approaches cannot give fixed addresses.
Want more on CloudFront and Global Accelerator? The 5 full-length practice sets have 7 more CloudFront and Global Accelerator questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →