Question 528 of 302
Maximize CloudFront Cache Hit Ratio by Excluding Authorization Header
A company serves public JavaScript and CSS files from S3 using CloudFront. After a frontend change, customers report a low CloudFront cache hit ratio. Requests now include an Authorization header, but these assets do not require authentication. The CloudFront distribution is configured such that Authorization is included in the cache key. Which change best maximizes cache reuse?
Quick Answer
The answer is to use a CloudFront Cache Policy that excludes the Authorization header from the cache key. This is correct because when the Authorization header is part of the cache key, every unique token creates a separate cached copy of the same static asset, fragmenting the cache and drastically reducing the hit ratio. Since public JavaScript and CSS files do not require authentication, excluding that header from the key allows all users to share a single cached object, maximizing reuse. On the SAA-C03 exam, this scenario tests your understanding of cache key design and the distinction between forwarding headers to the origin versus including them in the cache key—a common trap is assuming you must remove the header entirely, but a cache policy lets you forward it without affecting the key. Remember: for static assets, the cache key should only vary by URL, not by who is asking. Memory tip: "Auth in the key? Cache hit misery. Auth out of key? Cache hits for free."
⚠ Common exam trap
Watch out — candidates often assume including the Authorization header is necessary for correctness, but for public static assets, excluding it from the cache key is the correct way to maximize cache reuse without affecting delivery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a CloudFront Cache Policy that excludes Authorization from the cache key
Excluding the Authorization header from the cache key ensures that all users, regardless of their authentication token, receive the same cached object. Since the static assets (JavaScript/CSS) do not require authentication, including Authorization in the cache key creates multiple cache entries for the same file, drastically reducing the cache hit ratio. A CloudFront cache policy that omits Authorization from the cache key maximizes reuse while still allowing the header to be forwarded to the origin if needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Include the Authorization header in the cache key so responses vary correctly
Why it's wrong here
Including Authorization in the cache key causes CloudFront to treat requests with different Authorization values (for example, different tokens per user) as different cache objects, fragmenting the cache and lowering hit ratio for public assets.
- ✓
Use a CloudFront Cache Policy that excludes Authorization from the cache key
Why this is correct
Because the assets are public and do not depend on Authorization, excluding Authorization from the cache key allows all users to share the same cached objects. This reduces cache fragmentation and increases cache hit ratio.
- ✗
Disable caching and always fetch from S3
Why it's wrong here
Disabling caching eliminates reuse and forces every request to hit the origin (higher latency and higher S3/origin load), which is the opposite of improving cache hit ratio.
- ✗
Forward all headers and cookies to the origin to improve correctness
Why it's wrong here
Forwarding extra headers/cookies typically increases cache fragmentation unless they are excluded from the cache key. For public static assets, forwarding does not improve cache reuse and usually worsens hit ratio.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAA-C03
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company serves the same public content to many users through Amazon CloudFront. The origin is experiencing increased fetches because CloudFront cache hit rate is dropping. Most requests include an Authorization header and a custom header that changes per user. The response content is identical regardless of these headers. What change should the solutions architect make to restore a high cache hit rate?
medium- ✓ A.Create a custom cache policy that excludes the Authorization header and the per-user changing custom header from the cache key.
- B.Lower the TTL to a few seconds so cached objects expire sooner and origin fetches decrease.
- C.Disable caching for the affected paths so CloudFront always forwards all headers to the origin.
- D.Force all requests to use query-string based caching and include all headers in the cache policy for correctness.
Why A: CloudFront's default cache key includes the Authorization header and all custom headers, which causes unique cache entries for each user even though the content is identical. By creating a custom cache policy that excludes these headers from the cache key, CloudFront will treat requests with different header values as the same cached object, restoring a high cache hit rate and reducing origin fetches.
Last reviewed: Jun 11, 2026
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.