A per-operator Cisco API response is marked Cache-Control: private. Which reuse policy is correct?
Select an answer to reveal the explanation.
Short Explanation
A private locker is not the staff break-room fridge. private means only the intended client may reuse that body; public is the permission for a shared cache when the data is actually shareable.
Full Explanation
Cache-Control: private marks a response as intended for a single user agent or authorized client, not for shared caches that serve many municipal users. For a per-operator Cisco API response marked private, the correct reuse policy is to reuse the representation only for the intended client and never place it in a process-wide or edge cache shared across clerks. That protects operator-specific inventory views, tokens adjacent to personalized payloads, and role-filtered lists from leaking between sessions.
Placing the body in a process-wide shared cache served to every municipal user fails the private directive and can show Operator A’s filtered devices to Operator B. Treating private as identical to public and pushing the body to a shared edge cache fails for the same cross-user leakage reason at CDN scale. Publishing the representation to an anonymous intranet portal for faster lookups fails confidentiality and authorization boundaries entirely.
Exam caveat: private still allows a private (per-user) cache; it is not no-store. Combine with no-store when the body must not be written to disk at all. Shared reverse proxies must not cache private Cisco responses for reuse across sessions.
Operational check: verify the app’s HTTP cache keys include the authenticated operator identity for private responses, and that a second user on the same worker never receives the first user’s cached Cisco body.