A static web application uses CloudFront with an S3 origin for assets (JavaScript, CSS, images). After deploying a new frontend build, the CloudFront cache hit ratio dropped significantly because the S3 origin receives many repeated requests for the same assets. The team notices that requests now include the Authorization header in asset requests. Which change is most likely to restore cache efficiency and reduce origin request costs?

Keep the Authorization header but increase the cache TTL to 1 year to reduce revalidation frequency.

If Authorization values differ per user or session and Authorization is included in the cache key, the cache can still be fragmented into many unique cache entries. A larger TTL does not improve the hit ratio caused by cache key variability.

Remove CloudFront and serve assets directly from the S3 website endpoint to reduce CloudFront charges.

By removing CloudFront, requests would reach S3 more directly, typically increasing latency and often increasing total cost for high-traffic workloads due to loss of edge caching.

Switch the S3 origin from private access to public access so CloudFront can cache assets more effectively.

Origin access settings affect security (for example, OAC/OAI), not whether Authorization headers fragment the CloudFront cache key. Caching behavior should be corrected at the cache policy/origin request policy layer.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Update the CloudFront cache policy so that Authorization is excluded from the cache key for static asset paths. — The Authorization header is likely causing cache key fragmentation. If CloudFront includes Authorization in the cache key, different Authorization values produce different cache entries even when the asset URL is the same, which lowers cache hit ratio and increases origin fetches. Updating the CloudFront cache policy to exclude Authorization for static asset behaviors (and ensuring static assets don’t need user authentication to be served from the origin) restores cache efficiency and reduces S3 origin request costs. Increasing TTL can reduce the rate of revalidation, but it does not fix low hit ratio when the cache key changes per request due to Authorization variability. Removing CloudFront eliminates edge caching benefits. Making the S3 origin public does not address cache key behavior and is a security anti-pattern for most static asset hosting setups.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.