DOP-C02 Incident and Event Response Practice Question
A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer invalidated the CloudFront cache. What is the MOST likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The invalidation has not propagated to all edge locations.
CloudFront invalidations do not take effect immediately; they propagate to all edge locations over several minutes. Users may still receive cached content from an edge location that has not yet received the invalidation. Option A is incorrect because the origin is an S3 bucket, not an Application Load Balancer. Option C is incorrect because while the S3 bucket policy controls access, it does not cause CloudFront to serve stale content; invalidation forces CloudFront to fetch the updated object from S3 regardless of the bucket policy. Option D is incorrect because the default TTL setting is irrelevant when an explicit invalidation is performed; the invalidation overrides TTL and should clear the cache.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The origin is an Application Load Balancer that returns stale content.
Why it's wrong here
The origin for this distribution is an S3 bucket, not an Application Load Balancer, so this option misidentifies the architecture. Even if an ALB were present, stale responses would originate from origin-side caching or application state, not from CloudFront's cache distribution behavior. The reported symptom is a classic CloudFront edge-cache lag after an invalidation, not an origin version mismatch.
- ✓
The invalidation has not propagated to all edge locations.
Why this is correct
CloudFront invalidations are propagated to edge locations asynchronously, and the operation takes a finite amount of time to become effective globally. Until every POP has received and processed the invalidation, an edge that hasn't updated can still serve the old cached object to users. The invalidation status in the console may show 'InProgress' during this window, and only after propagation completes will all users receive the updated content.
- ✗
The S3 bucket policy does not allow CloudFront to access the updated objects.
Why it's wrong here
An S3 bucket policy either grants or denies access to the objects, and if CloudFront were denied, users would see 403 Forbidden errors or missing content rather than stale objects. The successful serving of old content proves that CloudFront had legitimate origin access and could fetch the previous version; it simply hasn't been updated at all edges yet. This option conflates authorization with cache invalidation behavior, which are distinct mechanisms.
- ✗
The CloudFront distribution has a default TTL of 86400 seconds set.
Why it's wrong here
A default TTL of 86400 seconds (24 hours) dictates how long CloudFront retains an object before rechecking the origin, but an explicit invalidation bypasses TTL and forces the object to be discarded immediately from cache. Since the invalidation was submitted, the TTL is irrelevant to the observed stale content; the issue is the physical propagation delay of that invalidation worldwide. Therefore, this option does not explain why stale content remains after the invalidation was requested.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.