Can a service worker cache a response from a different origin, like a CDN-hosted font or image?

Short interview answer

Yes, but a cross-origin response without CORS is stored as an opaque response — the cache can replay it, but JavaScript can't inspect its status code or body, so a failed request such as a 404 can be cached and replayed as if it succeeded; requesting the resource with CORS mode when possible avoids that blind spot.