A team serves static assets from an S3 origin through CloudFront. Cache hit ratio is low. Analytics show that requests include an Authorization header (even though the assets are public) and the cache key currently varies on that header, causing CloudFront to treat the same asset as different cache entries. What is the best change to improve cache hit ratio without breaking access controls?

Keep Authorization in the CloudFront cache key, but increase the origin response minimum TTL to 1 day.

A longer TTL can reduce some re-fetches, but varying the cache key by Authorization still creates separate cache entries for different Authorization values. That fragmentation remains the primary driver of a low hit ratio, and time-to-live settings do not change cache-key uniqueness.

Switch the S3 origin from the current bucket to a website endpoint to enable automatic caching headers.

Changing the origin type (REST endpoint vs website endpoint) does not remove cache-key variation caused by the Authorization header. CloudFront cache-key behavior is controlled by CloudFront cache policy/origin request policy, not by the origin endpoint type. This change also can introduce additional differences in behavior and error handling.

Enable CloudFront to forward all headers to S3 so origin can decide caching behavior per request.

Forwarding all headers typically reduces caching effectiveness because many header values vary per request, leading to more unique combinations and more cache misses. In this scenario, the key issue is cache-key configuration that includes Authorization; forwarding headers does not fix the underlying cache fragmentation and can make cache reuse worse.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Modify the CloudFront cache policy so the cache key does not include the Authorization header. — CloudFront cache hit ratio is driven by the cache key. When the cache key varies on Authorization, the same public asset requested with different Authorization values creates separate cache entries, lowering hit ratio. Updating the CloudFront cache policy to exclude Authorization from the cache key causes those requests to resolve to the same cached object at the edge. This improves cache reuse and reduces origin load while remaining safe because the assets are public. A only changes TTL while still fragmenting the cache by Authorization values. C changes the origin endpoint but does not change cache-key inputs, so low hit ratio remains likely. D forwards headers and can further reduce cache efficiency by making CloudFront caching more dependent on per-request header variability; it does not address the cache-key variation explicitly caused by Authorization.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.