Cloudflare Network Security flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Cloudflare reverse proxy model

Traffic resolves to Cloudflare anycast IPs, TLS terminates at the edge, and filtered requests are forwarded to the origin, hiding the origin IP from direct client access.

WAF custom rule expression

A filter combining fields such as ip.src, http.request.uri.path, and http.user_agent with operators and logical connectors, paired with an action like Block, Challenge, or Skip.

Managed Rules evaluation order

Cloudflare WAF evaluates Managed Rules before custom firewall rules, so an allow action requires a Skip rule rather than a Block-overriding permit expression.

Skip rule action

A WAF action that bypasses specified products or rules for matching requests; you select which WAF components, rate limits, or security features to exempt.

Managed Challenge action

A WAF action that issues a non-interactive browser challenge chosen by Cloudflare, falling back to interactive challenge only when needed, reducing friction versus JS Challenge.

Rate limiting counting expression

The field or combination of fields (IP, JA3, header, cookie) that groups requests for threshold counting; each unique value is tracked separately against the limit.

Rate limit mitigation timeout

The duration after a rate limit triggers during which matching requests are blocked or challenged before counting restarts, configurable from seconds to hours.

Bot score range

A value from 1 to 99 in cf.bot_management.score; lower scores indicate likely automation and higher scores likely human traffic, used in rule expressions.

Verified bot flag

The cf.bot_management.verified_bot field marks traffic from bots validated by Cloudflare's directory, such as known search engine crawlers, distinguishing them from unverified automation.

SSL/TLS Full (strict) mode

Encrypts edge-to-origin traffic and validates the origin certificate against a public CA or Cloudflare Origin CA, rejecting self-signed or expired certificates.

SSL/TLS Flexible mode

Encrypts only the client-to-edge leg while the edge connects to the origin over plain HTTP, leaving origin traffic unencrypted and vulnerable to interception.

Cloudflare Origin CA certificate

A certificate issued by Cloudflare for origin servers, trusted only by the Cloudflare edge, with validity up to 15 years and no public trust.

Cloudflare Tunnel

An outbound-only connection from cloudflared on the origin to Cloudflare's edge, letting you publish services without opening inbound firewall ports or exposing origin IPs.

Authenticated Origin Pulls

A setting requiring the origin to present a client certificate to Cloudflare, proving requests arrive through Cloudflare rather than directly from the internet.

HTTP DDoS Managed Rules

Preconfigured L7 DDoS mitigations with sensitivity levels High, Medium, Low, and Essentially Off, applying actions such as Block or Managed Challenge to attack traffic.

L3/L4 DDoS mitigation

Automatic, unmetered protection at the network and transport layers using anycast distribution and traffic scrubbing, requiring no configuration on the zone.

Always Use HTTPS

A zone setting that redirects HTTP requests to HTTPS with a 301 response, ensuring clients use the encrypted endpoint before other security products evaluate them.

HSTS enforcement

A response header instructing browsers to use HTTPS only for a max-age period; Cloudflare can add it with options for subdomains and preload list inclusion.

Minimum TLS version

A zone setting that rejects handshakes below the chosen TLS version (1.0 through 1.3), blocking obsolete protocol versions before content is served.

Opportunistic Encryption

A setting that adds an alt-svc header advertising HTTP/2 over TLS on port 443, allowing plain HTTP requests to be upgraded to encrypted transport.

Security Level setting

A zone control (Off, Essentially Off, Low, Medium, High, I'm Under Attack) that adjusts the threat score threshold at which visitors receive a challenge.

Under Attack Mode

A security level that presents an interstitial JavaScript challenge to all visitors before serving content, used during active L7 attacks.

IP Access Rules

Zone-level rules matching a single IP, IP range, country, or ASN, with Allow, Block, or Challenge actions applied before most other firewall evaluation.

Firewall rule action order

Within custom rules, evaluation proceeds in list order until a terminating action (Block, Challenge, Allow) matches; Log and Skip do not stop evaluation the same way.

Transform Rules

Rules that modify requests or responses without blocking, including URL rewrite, HTTP header modification, and managed transform settings applied at the edge.

Cloudflare Access policy

An identity-based Zero Trust rule that permits or denies requests to a protected hostname based on IdP authentication, group membership, or device posture.

WARP client

Cloudflare's device agent that routes user traffic through the Zero Trust network, enabling device posture checks and private network access without a traditional VPN.

Gateway DNS filtering

A Zero Trust policy layer that inspects DNS queries from WARP-connected devices and blocks or allows domains by category, list, or custom expression.

Logpush job

A configuration that streams selected datasets, such as HTTP requests or firewall events, to a destination like S3, GCS, or Splunk with field selection and filters.

GraphQL Analytics API

An API exposing aggregated zone metrics, including firewall events and security scores, queried by dataset, time range, and dimensions for reporting.

Security Events log

A dashboard and dataset recording requests mitigated by WAF, rate limiting, or bot rules, including matched rule ID, action, and request metadata for investigation.

Cloudflare API token scopes

Granular permissions assigned to an API token, such as Zone WAF Edit or Account Firewall Access Rules Edit, limited to specified zones or accounts.