How does CloudFront work, and how would you use it to serve a web app efficiently and securely?
What they are really testing: Whether you understand edge caching, origins, locking the origin down (OAC), and cache invalidation strategy, beyond "it is a CDN that makes things faster".
A real interview question
How does CloudFront work, and how would you use it to serve a web app efficiently and securely?
What most people say
drag me
“CloudFront is a CDN that caches your content in different locations to make your site faster.”
True but shallow. It misses origin security (OAC), path-based cache behaviors, and the invalidation strategy, which is where people actually get into trouble with stale content and surprise bills.
The follow-ups they ask next
How do you avoid stale assets after a deploy without constant invalidations?
Content-hash the filenames (app.[hash].js) and reference the new names from the HTML. New deploys produce new URLs, so caches never serve stale files and you skip costly invalidations; only the small HTML needs a short TTL.
How do you make sure users cannot bypass CloudFront and hit your S3 bucket directly?
Origin Access Control (OAC): the bucket policy only allows requests signed by your CloudFront distribution, and you block public access. Direct bucket URLs then return access denied.
What the interviewer is listening for
- Explains edge caching + origin offload
- Uses OAC to lock the origin
- Has a fingerprinted-asset invalidation strategy
What sinks the answer
- Only "a CDN that is faster"
- Leaves the S3 origin public
- Invalidates everything on every deploy
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“CloudFront [caches at edge locations near users, offloading the origin]. I set [origins (S3/ALB) and per-path cache behaviors, /static cached hard, /api passed through]. I secure it with [OAC so the S3 origin only accepts CloudFront, plus WAF and signed URLs]. For freshness I use [versioned asset names instead of invalidating every deploy].”
Keep going with aws
Foundation
What are the EC2 purchasing options (On-Demand, Reserved, Savings Plans, Spot), and how do you mix them?
Foundation
Walk me through the main S3 storage classes and how you would use lifecycle policies to control cost.
Junior
How does AWS decide whether an IAM request is allowed? Explain the evaluation logic.
Junior
How does an EC2 Auto Scaling Group work, and how would you configure it to scale on load?
Mid
How do you choose between SQS, SNS, EventBridge, and Kinesis?
Mid
What are VPC endpoints, and when would you use a gateway endpoint versus an interface endpoint?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free