How to Improve CloudFront Cache Hit Ratio for Versioned Static Assets
A marketing site serves versioned JavaScript and CSS files from Amazon S3 through CloudFront. The origin bill is rising because CloudFront keeps fetching the same files too often, and the application never changes a file at the same URL once it is published. Which two changes should you make? Select two.
Quick Answer
The answer is to configure long-lived Cache-Control headers like `max-age=31536000` and `immutable` on your versioned assets, and to adjust the CloudFront cache policy to stop forwarding unnecessary query strings, headers, or cookies. This works because versioned assets have unique URLs that never change, so aggressive caching at both the CloudFront edge and the browser eliminates redundant origin fetches, directly reducing your S3 origin bill. On the SAA-C03 exam, this scenario tests your understanding of how to optimize CloudFront performance and cost for static content, often appearing as a multi-select question where one trap is choosing to shorten the TTL or enable compression instead. Remember the key insight: if the file URL changes with each version, you can safely set an extremely long cache duration. A useful memory tip is "Versioned URLs = Immutable Cache" — treat them like a library book with a unique barcode that never needs re-scanning.
⚠ Common exam trap
Candidates often think disabling caching (Option D) or adding more cache key variations (Option E) will improve performance, but both increase origin load and costs, while the correct approach is to leverage versioned URLs with aggressive caching headers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set long-lived Cache-Control headers, such as a high max-age and immutable policy, on the versioned assets.
Setting long-lived Cache-Control headers (e.g., `max-age=31536000` and `immutable`) on versioned assets tells CloudFront and browsers to cache the files aggressively. Since the application never changes a file at the same URL, this eliminates redundant origin fetches, directly reducing the origin bill.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set long-lived Cache-Control headers, such as a high max-age and immutable policy, on the versioned assets.
Why this is correct
Versioned assets are ideal for long cache lifetimes because their URLs change when the content changes. Strong Cache-Control headers let CloudFront serve more requests from edge locations instead of repeatedly fetching the same files from S3.
- ✓
Configure the CloudFront cache policy to avoid forwarding unnecessary query strings, headers, and cookies.
Why this is correct
A smaller cache key improves the cache hit rate because more viewer requests map to the same cached object. Avoiding unnecessary request attributes also reduces origin fetches and lowers the bandwidth sent to the origin.
- ✗
Move the static assets to an EC2 web server behind an Application Load Balancer.
Why it's wrong here
This adds infrastructure cost and operational overhead without addressing the root cause of the problem. The issue is poor cache efficiency, not the inability of S3 to serve the files.
When this WOULD be correct
A question where the static assets require dynamic server-side processing (e.g., personalized CSS/JS) or where the origin must support custom headers/authentication that S3 cannot provide, and the goal is to reduce latency or add compute before serving.
- ✗
Disable CloudFront caching so every request always reaches the origin.
Why it's wrong here
Disabling caching would increase origin traffic and make the bill worse. The scenario specifically needs fewer origin fetches, so this is the opposite of the desired outcome.
When this WOULD be correct
If the question required real-time content updates where stale data is unacceptable (e.g., live stock prices or breaking news), and the origin can handle the load, disabling caching would ensure viewers always get the latest version.
- ✗
Add more viewer-facing headers to the cache key so each browser variation gets a unique cached object.
Why it's wrong here
Expanding the cache key usually lowers the hit rate because more requests become unique. That increases origin traffic and defeats the purpose of using CloudFront to reduce cost.
When this WOULD be correct
A question where the application serves different content based on browser type (e.g., mobile vs desktop) and the goal is to ensure each browser variation gets the correct cached version, even if it increases origin fetches.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Set long-lived Cache-Control headers, such as a high max-age and immutable policy, on the versioned assets.Correct answer▾
Why this is correct
Versioned assets are ideal for long cache lifetimes because their URLs change when the content changes. Strong Cache-Control headers let CloudFront serve more requests from edge locations instead of repeatedly fetching the same files from S3.
✗Move the static assets to an EC2 web server behind an Application Load Balancer.Wrong answer — click to see why▾
Why this is wrong here
Moving assets to EC2 behind an ALB increases cost and complexity without addressing the root cause of excessive origin fetches; CloudFront already caches from S3, and the issue is cache hit ratio, not origin type.
★ When this WOULD be the correct answer
A question where the static assets require dynamic server-side processing (e.g., personalized CSS/JS) or where the origin must support custom headers/authentication that S3 cannot provide, and the goal is to reduce latency or add compute before serving.
Why candidates choose this
Candidates may think EC2+ALB is more 'powerful' or 'flexible' than S3, or assume that moving off S3 will somehow reduce costs, without realizing that CloudFront caching is the key to reducing origin fetches.
✗Disable CloudFront caching so every request always reaches the origin.Wrong answer — click to see why▾
Why this is wrong here
Disabling CloudFront caching would force every request to go to the S3 origin, increasing origin load and costs, which is the opposite of the goal to reduce origin fetches.
★ When this WOULD be the correct answer
If the question required real-time content updates where stale data is unacceptable (e.g., live stock prices or breaking news), and the origin can handle the load, disabling caching would ensure viewers always get the latest version.
Why candidates choose this
Candidates may think disabling caching eliminates stale content issues, but they overlook that the problem is about reducing origin fetches, not about freshness.
✗Add more viewer-facing headers to the cache key so each browser variation gets a unique cached object.Wrong answer — click to see why▾
Why this is wrong here
Adding more viewer-facing headers to the cache key increases cache fragmentation, reducing cache hit ratio and causing more origin fetches, which is the opposite of the desired outcome.
★ When this WOULD be the correct answer
A question where the application serves different content based on browser type (e.g., mobile vs desktop) and the goal is to ensure each browser variation gets the correct cached version, even if it increases origin fetches.
Why candidates choose this
Candidates may think that customizing cached content per browser variation improves performance, but they overlook that versioned assets are immutable and don't need such differentiation.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAA-C03
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A marketing site serves versioned JavaScript and CSS files from an Amazon S3 origin through Amazon CloudFront. After a frontend release, the CloudFront cache hit ratio dropped because browsers now send an Authorization header on every static asset request even though the assets are public and do not require authentication. The team wants to lower origin load and improve cache efficiency. Which two actions should it take? Select two.
medium- ✓ A.Create a separate CloudFront behavior for static assets with a cache policy and origin request policy that exclude the Authorization header.
- ✓ B.Use hashed or versioned object names and long Cache-Control max-age values for immutable assets.
- C.Forward the Authorization header to the origin for all static asset requests.
- D.Set the cache TTL to zero so browsers always revalidate content.
- E.Store the static assets in Amazon EFS so CloudFront can cache them more effectively.
Why A: Creating a separate CloudFront behavior for static assets allows you to attach a cache policy and an origin request policy that explicitly exclude the Authorization header. By not forwarding the Authorization header to the S3 origin, CloudFront can treat all requests for the same asset as cache hits, regardless of the header value, which restores the cache hit ratio and reduces origin load.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.