Cloudflare Application Security study plan

Explain how DNS resolution, TCP/TLS handshakes, and HTTP request/response cycles interact so you can trace a single request end to end

Classify the OWASP Top 10 categories by where they are enforced (origin app, edge, or both) and note one mitigation point for each

Describe the difference between a reverse proxy, a CDN, and an edge security platform in terms of what each can inspect

Map the Cloudflare edge request path (DNS, TLS termination, cache, WAF, origin) and identify which layer sees plaintext

Define the CIA triad and give one web-specific example of each violation

Differentiate reflected, stored, and DOM-based XSS and identify which are detectable at the edge versus only in the browser

Explain how SQL injection, command injection, and path traversal payloads differ structurally and why signature matching struggles with obfuscation

Describe CSRF defenses (SameSite cookies, tokens, origin checks) and where an edge platform can enforce origin validation

Compare TLS versions, cipher suites, and HSTS behavior, and state what a downgrade attack looks like on the wire

Summarize how cache poisoning and cache deception abuse CDN behavior and what header hygiene prevents each

Explain how a WAF rule engine evaluates a request: matching phase, rule ordering, and action precedence

Contrast signature-based, anomaly-scoring, and managed-ruleset approaches and state the false-positive tradeoff of each

Write custom rules using expression syntax that combine request fields, IP lists, and path conditions with logical operators

Describe the OWASP Core Rule Set philosophy (paranoia levels, anomaly thresholds) without relying on any vendor documentation

Identify what a WAF cannot see (encrypted payloads after client-side encryption, multi-request business logic abuse) and why

Distinguish allowlist, block, challenge, and log-only actions and predict the user impact and telemetry of each

Design a staged rollout for a new WAF rule (log, then simulate, then challenge, then block) with rollback criteria

Interpret WAF event logs to reconstruct why a specific request was blocked, including which rule and which field matched

Explain how rate limiting rules differ from WAF rules in statefulness and windowing, and when to combine them

Tune out a false positive without disabling the whole ruleset, using exceptions scoped to a path or parameter

Categorize DDoS attack types by layer (network, transport, application) and by volumetric, protocol, and resource-exhaustion intent

Explain how anycast, BGP routing, and traffic scrubbing centers absorb a volumetric flood and where the traffic is dropped

Describe SYN flood, UDP amplification, DNS amplification, and HTTP flood mechanics and one distinguishing signature of each

Explain how caching and static asset offload reduce origin load during an application-layer flood

State what an under-attack posture looks like: what changes, who decides, and what metrics trigger escalation

Differentiate L3/L4 protection from L7 protection in terms of what traffic characteristics each can inspect

Explain how challenge pages, JavaScript challenges, and managed challenge selection differ in friction and in what they prove about the client

Describe adaptive rate limiting and how thresholds can key on path, header, or client fingerprint rather than IP alone

Interpret traffic analytics during an attack: requests per second, cache hit ratio, error rate, and origin health signals

Explain why IP reputation and geolocation blocking are weak standalone defenses in a botnet or proxy-heavy attack

Explain how bot detection signals combine: IP reputation, ASN, TLS/JA3-JA4 fingerprint, HTTP/2 fingerprint, header order, and behavioral telemetry

Distinguish good bots (search crawlers, monitoring, payment providers) from bad bots and describe verification via IP-to-ASN or reverse DNS

Describe common evasion techniques (residential proxies, headless browsers, CAPTCHA-solving services) and the counter-signal each leaves

Explain how machine-learning bot scores are produced and consumed, and why a score is a probability rather than a verdict

Compare static, JA3, and dynamic field interception approaches to protecting login and checkout endpoints from credential stuffing

Integrate the four domains into a single defense-in-depth narrative for one realistic e-commerce request path

Diagnose 5 mixed-discipline scenarios (for example, a slowloris flood masked as bot traffic hitting a WAF-protected endpoint) and rank the correct response order

Audit your own weak areas against the domain weightings and list the three concepts you would still miss under exam pressure

Practice timed recall by answering 40 self-written questions across all domains in 50 minutes

Re-derive the key distinctions (WAF vs rate limiting, challenge vs block, L3 vs L7, good vs bad bot) from memory in writing