A team serves static web assets (JS, CSS, images) from an Amazon S3 origin through CloudFront. Recently, the S3 origin has received a high number of requests for the same files, increasing origin data transfer costs. CloudFront access logs show many cache misses, and each request includes a unique query string used only for tracking (for example, ?utm=...). The application does not require query-string-specific content. What CloudFront change will most directly reduce origin fetches and cost?

Lower the minimum TTL and set Cache-Control headers to no-store to force CloudFront to revalidate more often.

no-store (or effectively forcing revalidation/short TTLs) reduces cache effectiveness. That increases the number of requests that must reach the origin or be revalidated, which directly increases origin fetches and cost—opposite of the goal.

Enable Origin Shield to ensure all origin fetches go through a single regional shield with no other configuration changes.

Origin Shield can reduce origin load in some scenarios by improving cache coordination, but it does not change what constitutes a unique cache object. If query strings remain in the cache key, CloudFront will still treat each unique tracking query string as a different cache object, so cache misses and origin fetches will remain high.

Switch the S3 origin from S3 to a different storage class optimized for request rates, keeping the cache key the same.

Changing the S3 storage class does not address the root cause: CloudFront cache fragmentation caused by query strings in the cache key. Even with a different storage class, CloudFront will still generate separate cache entries (and therefore origin fetches) for each unique query string.

What does this SAA-C03 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Update the CloudFront cache policy to exclude query strings from the cache key so that requests differing only by tracking query parameters reuse the same cached object. — CloudFront is generating many cache misses because the cache key varies by a tracking query string. When unique query parameter values (for example, ?utm=...) are included in the cache key, CloudFront treats each variant as a separate object, even though the content is identical. This results in repeated origin fetches from S3, increasing origin data transfer cost. Excluding query strings from the CloudFront cache key makes those requests map to the same cached object, raising the cache hit ratio and directly reducing origin fetch volume and cost. Forcing more frequent revalidation or using no-store reduces caching and increases origin traffic. Origin Shield can help with origin load coordination, but it does not change the cache key; therefore it does not eliminate cache fragmentation caused by tracking query strings. Changing the S3 storage class does not affect how CloudFront forms the cache key or the resulting cache miss rate.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.