A site serves static assets (JS/CSS) through CloudFront from an S3 origin. After a recent frontend change, CloudFront shows a cache hit ratio below 20%. In CloudFront access logs, requests to the same asset URL path differ by a query parameter named rnd (a random value appended by the app on every request). The origin content is identical regardless of rnd. What is the best CloudFront configuration change to restore effective caching?

Increase the origin response Cache-Control max-age header on S3 so CloudFront caches longer even with different rnd values.

Increasing TTL affects how long each cached object remains, but it does not change how CloudFront partitions the cache. If rnd is part of the cache key, you will still generate a distinct cache entry per rnd value, keeping hit ratio low regardless of TTL.

Disable compression on CloudFront so the response body is identical byte-for-byte and cache hits improve.

Compression settings affect how the response is transferred and can change which variants are stored, but they do not address the primary driver of low hit ratio here: different cache keys caused by varying query parameters. If rnd remains in the cache key, cache misses will persist.

Switch the origin from S3 to an ALB so CloudFront can cache based on ALB target health checks instead of the query string.

CloudFront cache keys are determined by the Cache Policy (headers/query strings/cookies, etc.), not by the origin type or target health checks. Changing the origin to an ALB adds complexity and does not fix cache fragmentation caused by rnd being included in the cache key.

What does this SAA-C03 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Create a custom CloudFront Cache Policy that does not include the rnd query parameter in the cache key (whitelist only required parameters, or forward no query strings). — CloudFront uses a Cache Policy to determine the cache key. If the Cache Policy includes the rnd query parameter, each unique rnd value creates a separate cache entry, drastically reducing the hit ratio even though the origin response is identical. The correct fix is to update the Cache Policy to exclude rnd (or forward only query parameters that actually affect the response), so requests for the same asset path share cached objects. (A) TTL changes expiration time but not cache-key cardinality; different rnd values still cause different cache entries. (C) Compression does not remove cache-key differences from query strings. (D) Cache behavior is not driven by ALB health checks; Cache Policy determines cache key composition, so switching origins does not resolve the query-string-driven fragmentation.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.