I85PREP
⌘ K
Cloudflare Network Security study materials
Cloudflare Network Security study resources

Cloudflare Network Security practice questions

One question at a time. Build your Cloudflare Network Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security

In Cloudflare's network security model, which component sits in front of an origin server and inspects HTTP traffic before it reaches the origin?

  1. The registrar's WHOIS service
  2. The origin's local firewall daemon
  3. The customer's recursive DNS resolver
  4. The Cloudflare reverse proxy edge Correct answer.

Explanation

When a hostname is proxied through Cloudflare, client requests terminate at Cloudflare's edge, which applies WAF, DDoS, and other security products before forwarding allowed traffic to the origin. The origin firewall only sees traffic that the edge already passed, and DNS/WHOIS services do not inspect HTTP payloads.

Question 2Network Security

Which Cloudflare feature is designed primarily to absorb volumetric and protocol-layer attacks before they reach an origin?

  1. Transform Rules
  2. Page Rules
  3. Health Checks
  4. Cloudflare DDoS protection Correct answer.

Explanation

Cloudflare's DDoS protection is an always-on, automated system that detects and mitigates volumetric, protocol, and application-layer floods at the edge. Page Rules, Transform Rules, and Health Checks are configuration and traffic-management features, not the primary DDoS mitigation layer.

Question 3Network Security

A security team wants to block requests whose User-Agent exactly matches a known malicious string using the Cloudflare WAF. Which rule type is the most direct fit?

  1. A custom WAF rule with a matching expression Correct answer.
  2. A cache rule that bypasses caching
  3. A rate limiting rule keyed on the client IP
  4. An origin certificate rotation policy

Explanation

Custom WAF rules evaluate expressions against request fields such as http.user_agent, so an exact-match condition on the User-Agent is expressed directly there. Rate limiting counts requests over time rather than matching a header value, and cache or certificate settings do not block requests.

Question 4Network Security

What is the primary purpose of Cloudflare's SSL/TLS encryption mode setting?

  1. To define how traffic between Cloudflare and the origin is encrypted Correct answer.
  2. To determine which countries may access the site
  3. To choose the cipher suites offered to browsers only
  4. To set the certificate validity period at the edge

Explanation

The SSL/TLS mode (such as Flexible, Full, or Full Strict) governs the connection between Cloudflare's edge and the origin server. Edge-to-client TLS is handled separately, and cipher selection, certificate lifetime, and geo access are controlled by other settings.

Question 5Network Security

Which Cloudflare capability lets an administrator block or challenge visitors by country, IP range, or autonomous system number?

  1. Bot Fight Mode
  2. Tiered Caching
  3. IP Access Rules Correct answer.
  4. Argo Smart Routing

Explanation

IP Access Rules let you allow, block, or challenge traffic based on IP address, IP range, country, or ASN. Bot Fight Mode targets automated traffic behavior, while Argo and Tiered Caching are performance features.

Question 6Network Security

What does enabling 'Full (strict)' SSL/TLS mode require of the origin server?

  1. A valid certificate that Cloudflare can verify for the origin hostname Correct answer.
  2. An open HTTP port without TLS
  3. A self-signed certificate with no chain
  4. A certificate issued only for the apex domain

Explanation

Full (strict) requires the origin to present a certificate that is valid, unexpired, and trusted (public CA or uploaded Cloudflare CA), so the edge can authenticate the origin. Plain HTTP, untrusted self-signed certificates, and mismatched hostnames fail this validation.

Question 7Network Security

Which statement best describes Cloudflare's Web Application Firewall managed rulesets?

  1. They replace the need for any TLS configuration.
  2. They are curated rule groups maintained by Cloudflare that cover common attack patterns. Correct answer.
  3. They only apply to WebSocket traffic.
  4. They are rules the customer must write from scratch for each attack.

Explanation

Managed rulesets are maintained by Cloudflare and updated as new threats emerge, covering categories such as OWASP-style injection and protocol anomalies. Customers can tune them but do not author them, and they are independent of transport security settings.

Question 8Network Security

An administrator wants to challenge only requests that lack a valid session cookie while allowing normal visitors through. Which Cloudflare construct expresses this most precisely?

  1. A global rate limit applied to every URI
  2. A DNS-only (grey-cloud) record
  3. An Always Use HTTPS redirect
  4. A custom WAF rule whose expression checks for the cookie's absence Correct answer.

Explanation

Custom WAF rules can test request attributes such as cookie presence and apply a challenge action only when the condition matches, giving precise scoping. Global rate limits apply to all matching traffic regardless of cookie state, and redirects or DNS-only records do not challenge requests.

Question 9Network Security

A customer enables a WAF custom rule that blocks requests where http.request.uri.path contains '/admin' and the source IP is not in an allowlist. What is the expected effect?

  1. All requests to /admin are blocked regardless of source.
  2. Requests to /admin from IPs outside the allowlist are blocked. Correct answer.
  3. The rule blocks the origin from serving any path.
  4. Only GET requests to /admin are blocked.

Explanation

The expression combines two conditions with AND semantics: the path must contain /admin and the IP must not be allowlisted, so only non-allowlisted sources are blocked. Allowlisted IPs satisfy the negation and pass, and the rule says nothing about HTTP method.

Question 10Network Security

Which Cloudflare product is specifically intended to detect and mitigate sophisticated automated bots using behavioral analysis and machine learning?

  1. Bot Management Correct answer.
  2. Load Balancing
  3. Spectrum
  4. Cache Reserve

Explanation

Bot Management scores requests using behavioral and heuristic signals to distinguish good bots from bad ones. Spectrum handles non-HTTP protocols, Load Balancing distributes traffic across origins, and Cache Reserve extends cache storage.

Question 11Network Security

A security engineer wants to limit login attempts to 5 per minute per IP on the /login path. Which Cloudflare feature fits this requirement?

  1. A cache rule with a long TTL
  2. A redirect rule to the homepage
  3. A rate limiting rule scoped to the path Correct answer.
  4. An HSTS header setting

Explanation

Rate limiting rules count requests over a period and can be scoped by path and keyed by client IP, then take action such as blocking or challenging. Cache, redirect, and HSTS settings do not count requests or enforce attempt thresholds.

Question 12Network Security

What is the role of the Cloudflare 'Under Attack Mode' setting?

  1. It presents an interstitial JavaScript challenge to most visitors during an attack. Correct answer.
  2. It routes traffic directly to the origin, bypassing the edge.
  3. It permanently blocks all traffic from a region.
  4. It disables TLS for faster response.

Explanation

Under Attack Mode issues a JavaScript challenge to most visitors so that automated floods are filtered while genuine browsers can proceed. It is a temporary mitigation, not a permanent geo block, and it does not disable TLS or bypass the edge.

Question 13Network Security

Which header does Cloudflare add to responses to indicate whether a request was served from cache, and why is it useful in security investigations?

  1. X-Frame-Options, showing framing policy
  2. Strict-Transport-Security, showing TLS policy
  3. Content-Security-Policy, showing script sources
  4. CF-Cache-Status, showing cache outcome for the request Correct answer.

Explanation

CF-Cache-Status reports whether a response was a cache hit, miss, or bypass, which helps analysts determine whether a request reached the origin or was served at the edge. The other headers describe security policies rather than request routing.

Question 14Network Security

A team wants to ensure that only requests carrying a valid Cloudflare-issued client certificate can reach a protected API. Which feature should they configure?

  1. Mutual TLS (mTLS) with client certificate validation Correct answer.
  2. Automatic HTTPS Rewrites
  3. Authenticated Origin Pulls in the reverse direction
  4. Brotli compression

Explanation

Mutual TLS requires clients to present certificates that Cloudflare validates before forwarding requests, restricting access to credentialed clients. Authenticated Origin Pulls secures the edge-to-origin leg, while HTTPS Rewrites and Brotli are unrelated to client authentication.

Question 15Network Security

How does Cloudflare's proxy status (orange cloud versus grey cloud) affect security features on a DNS record?

  1. Grey cloud enables WAF and DDoS protection; orange cloud disables them.
  2. The setting only affects email routing.
  3. Orange cloud routes traffic through Cloudflare so edge security applies; grey cloud exposes the origin directly. Correct answer.
  4. Both settings apply identical edge protections.

Explanation

An orange-clouded record resolves to Cloudflare addresses, so WAF, DDoS, and bot protections apply. A grey-clouded record resolves directly to the origin, so those edge protections no longer sit in the request path.

Question 16Network Security

Which Cloudflare setting helps prevent an attacker from downgrading a browser connection from HTTPS to HTTP on subsequent visits?

  1. Email obfuscation enabled
  2. IPv6 compatibility enabled
  3. Rocket Loader enabled
  4. HSTS enabled with a suitable max-age Correct answer.

Explanation

HTTP Strict Transport Security tells browsers to use HTTPS exclusively for the host for the configured period, blocking downgrade attempts. Rocket Loader, email obfuscation, and IPv6 compatibility affect performance or content, not transport enforcement.

Question 17Network Security

An analyst observes a spike in requests with rotating IPs but identical TLS fingerprints and header order. Which Cloudflare capability best helps classify this traffic?

  1. Cache Analytics
  2. DNS record export
  3. Bot Management using fingerprint and behavioral signals Correct answer.
  4. Logpush to a spreadsheet

Explanation

Bot Management incorporates signals such as TLS/JA3-style fingerprints and header consistency to detect automated clients even when source IPs rotate. Cache Analytics and DNS exports describe traffic or configuration but do not classify clients, and a spreadsheet is only a destination for logs.

Question 18Network Security

What is the purpose of Cloudflare's Security Level setting?

  1. It controls the cache TTL for static assets.
  2. It adjusts how aggressively the edge challenges visitors based on threat score. Correct answer.
  3. It determines the number of origin pools.
  4. It sets the TLS version used to the origin.

Explanation

Security Level tunes the threat-score threshold at which visitors receive challenges, ranging from essentially off to aggressively challenging. It does not set TLS versions, define origin pools, or control cache TTLs.

Question 19Network Security

A customer wants to allow only specific countries to reach an application while blocking all others. Which approach uses Cloudflare features correctly?

  1. A WAF custom rule that blocks requests where ip.geoip.country is not in the approved list Correct answer.
  2. A redirect rule that sends all traffic to HTTPS
  3. A page rule that disables performance features
  4. A cache rule that varies cache by country

Explanation

WAF custom rules can evaluate ip.geoip.country and block any request outside the approved set, giving an allowlist model. Cache rules, redirects, and performance page rules do not enforce geographic access control.

Question 20Network Security

Which Cloudflare feature provides a managed list of known malicious IPs and bot signatures that can be referenced in firewall rules?

  1. Cloudflare Managed Lists (such as the Open Proxy and Bot lists) Correct answer.
  2. Spectrum applications
  3. Argo Tunnel connectors
  4. Waiting Room queues

Explanation

Cloudflare maintains managed lists of threat intel, including open proxies and known bots, which rules can reference directly. Argo Tunnel, Spectrum, and Waiting Room address connectivity, protocol proxying, and traffic queuing rather than threat lists.

Question 21Network Security

A rule expression uses 'not http.host in {"api.example.com"}' to block traffic. Which unintended consequence should the engineer check first?

  1. Requests where the Host header is absent or unexpected are also blocked Correct answer.
  2. The rule stops cache purging
  3. Only IPv6 clients are affected
  4. The rule disables TLS for the zone

Explanation

Negated allowlists match any request whose Host does not equal the listed value, including missing or unexpected Host headers, which can block legitimate traffic. The expression does not selectively affect IPv6, alter TLS, or affect cache purging.

Question 22Network Security

An origin is protected by Authenticated Origin Pulls, but an attacker has obtained the origin IP and is sending requests directly. Why does Authenticated Origin Pulls still block those requests?

  1. The origin IP changes on every request
  2. The attacker cannot resolve DNS
  3. The attacker's IP is automatically added to a blocklist
  4. The origin accepts only connections presenting the Cloudflare client certificate Correct answer.

Explanation

Authenticated Origin Pulls makes the origin require a Cloudflare-presented client certificate on the TLS handshake, so direct connections without that certificate are rejected even if the IP is known. It does not rely on blocklists, IP rotation, or DNS secrecy.

Question 23Network Security

A rate limiting rule counts requests per IP but attackers distribute requests across many IPs. Which adjustment best addresses distributed low-and-slow abuse?

  1. Key the rule on a stable attribute such as a session cookie or path, and lower thresholds accordingly Correct answer.
  2. Remove the path filter so all requests count
  3. Switch the action from block to log only
  4. Increase the counting period to one month

Explanation

Distributed sources defeat per-IP counting, so keying on a stable attribute the attacker cannot easily rotate, such as a session cookie or a specific endpoint, combined with tuned thresholds, catches low-and-slow abuse. Removing filters or extending the window dilutes detection, and logging only removes enforcement.

Question 24Network Security

Which statement correctly distinguishes Cloudflare's WAF from its DDoS protection for application-layer attacks?

  1. WAF only works on UDP traffic, while DDoS protection handles HTTP
  2. DDoS protection requires per-request signatures written by the customer
  3. WAF rules match request content and apply actions; DDoS protection detects anomalous flood patterns automatically Correct answer.
  4. WAF and DDoS protection are the same engine with different names

Explanation

The WAF evaluates expressions against request attributes and takes configured actions, while DDoS protection uses automated anomaly detection to absorb floods without per-request customer rules. They are complementary systems, and the WAF operates on HTTP(S) rather than only UDP.

Question 25Network Security

A team wants to test a new WAF custom rule without affecting users. Which approach is most appropriate in Cloudflare?

  1. Disable the WAF entirely during testing
  2. Apply the rule only to the origin firewall
  3. Deploy the rule with a Log action first, review matches, then switch to Block Correct answer.
  4. Deploy the rule directly as Block across all traffic

Explanation

Using the Log action lets the rule evaluate and record matches without blocking, so false positives can be reviewed before enforcement. Blocking immediately risks outages, disabling the WAF removes protection, and shifting to the origin firewall does not test the edge rule.

Question 26Network Security

In Cloudflare's shared proxy model, what does the term 'orange cloud' indicate for a DNS record?

  1. The record is a CNAME flattening target only used for apex records.
  2. The record is disabled and returns NXDOMAIN until re-enabled.
  3. Traffic for the record resolves directly to the origin and bypasses Cloudflare entirely.
  4. Traffic for the record is proxied through Cloudflare and security features can apply. Correct answer.

Explanation

An orange-clouded record resolves to Cloudflare anycast addresses, so HTTP/S traffic flows through the edge where WAF, DDoS mitigation, and caching can act on it. A grey-clouded record publishes the origin address directly, so those edge protections do not see the traffic.

Question 27Network Security

Which Cloudflare capability inspects HTTP request bodies and headers against signatures to block known application-layer exploits such as SQL injection?

  1. Cloudflare Registrar
  2. Spectrum
  3. Argo Smart Routing
  4. Web Application Firewall Correct answer.

Explanation

The WAF evaluates request fields including URI, headers, and body against managed rulesets and custom rules to block or challenge malicious payloads. Spectrum handles arbitrary TCP/UDP proxying, Registrar handles domain registration, and Argo optimizes routing; none of them perform payload signature inspection.

Question 28Network Security

What is the primary purpose of a Cloudflare rate limiting rule configured on a specific URI path?

  1. To force all requests on that path to use HTTP/3
  2. To cap how many matching requests are allowed in a time window and take an action when exceeded Correct answer.
  3. To require client certificates for that path
  4. To cache responses for that path more aggressively

Explanation

A rate limiting rule counts matching requests per chosen characteristic over a defined period and triggers an action such as block or challenge once the threshold is crossed. It is a throttling control, not a caching, protocol, or authentication mechanism.

Question 29Network Security

Which Cloudflare offering is designed to proxy and protect non-HTTP protocols such as SSH or arbitrary TCP/UDP on custom ports?

  1. Page Rules
  2. Cloudflare Access
  3. SSL/TLS Universal Certificates
  4. Spectrum Correct answer.

Explanation

Spectrum extends Cloudflare's edge to arbitrary TCP and UDP applications, providing DDoS protection and proxying for protocols that the HTTP-focused edge does not handle. Access is an identity-aware proxy for HTTP applications, Page Rules modify HTTP behavior, and Universal SSL issues certificates.

Question 30Network Security

What does Cloudflare's Always Use HTTPS setting accomplish for a zone?

  1. It redirects HTTP requests to the HTTPS version of the same URL. Correct answer.
  2. It forces visitors to install a client certificate before connecting.
  3. It disables HTTP/2 to avoid protocol downgrade attacks.
  4. It encrypts traffic between Cloudflare and the origin using a pinned certificate.

Explanation

Always Use HTTPS issues redirects from http:// to https:// for the zone so visitors land on the encrypted endpoint. Origin-side encryption is controlled by SSL/TLS mode and Authenticated Origin Pulls, not by this redirect setting.

Question 31Network Security

Which Cloudflare feature lets an administrator define a rule that blocks requests based on the value of the User-Agent header?

  1. Custom WAF rules Correct answer.
  2. Health Checks
  3. Load Balancing
  4. Cache Analytics

Explanation

Custom WAF rules use the Cloudflare Rules language, which exposes fields such as http.user_agent, allowing blocks or challenges based on header values. Health Checks monitor origin availability, Load Balancing distributes traffic, and Cache Analytics reports cache performance.

Question 32Network Security

What is the function of Cloudflare's DDoS protection at the network edge for a proxied zone?

  1. It rewrites HTML responses to remove inline scripts.
  2. It issues and renews origin certificates automatically.
  3. It compresses images to reduce bandwidth costs.
  4. It detects and absorbs volumetric and protocol attacks before they reach the origin. Correct answer.

Explanation

Cloudflare's always-on DDoS mitigation inspects traffic at the edge and drops or absorbs attack traffic so the origin is shielded from volumetric and protocol floods. Response rewriting, certificate issuance, and image optimization are handled by separate products.

Question 33Network Security

Which Cloudflare product provides an identity-aware proxy that enforces authentication before users can reach an internal application?

  1. Cloudflare Gateway
  2. Cloudflare WAF
  3. Cloudflare Tunnel
  4. Cloudflare Access Correct answer.

Explanation

Access sits in front of an application and evaluates identity and device posture through an identity provider before granting entry. Gateway filters outbound traffic, Tunnel establishes the connection from origin to edge, and WAF inspects HTTP payloads rather than user identity.

Question 34Network Security

A customer wants to block requests whose URI path matches a regular expression without writing a full custom ruleset. Which Cloudflare construct is the most direct fit?

  1. A WAF custom rule using the matches operator on http.request.uri.path Correct answer.
  2. A DNS record with a proxied A entry
  3. A Page Rule with a wildcard pattern
  4. A cache rule with a bypass setting

Explanation

The WAF custom rules engine supports the matches operator with regular expressions against fields such as http.request.uri.path, allowing precise path blocking. Page Rules use simpler wildcard matching, DNS records do not filter requests, and cache rules control caching rather than blocking.

Question 35Network Security

An administrator sets a WAF custom rule action to 'Managed Challenge' for requests to a sensitive endpoint. What behavior should visitors expect?

  1. Cloudflare presents a challenge that most legitimate browsers pass automatically while suspicious clients are blocked from proceeding. Correct answer.
  2. The request is dropped immediately with a 403 response.
  3. The origin receives the request only after a client certificate is presented.
  4. The request is served from cache regardless of cache headers.

Explanation

Managed Challenge lets Cloudflare choose the appropriate challenge type based on the request's signals, so ordinary browsers usually pass transparently while automated or suspicious clients fail. It is not an unconditional block, a cache override, or an mTLS requirement.

Question 36Network Security

A security team wants to inspect and filter outbound traffic from corporate devices to known-malicious domains. Which Cloudflare product addresses this?

  1. Cloudflare Gateway Correct answer.
  2. Cloudflare Load Balancing
  3. Cloudflare WAF
  4. Cloudflare Access

Explanation

Gateway is Cloudflare's secure web gateway, applying DNS, HTTP, and network policies to outbound traffic from enrolled devices. Access governs inbound access to applications, WAF inspects inbound HTTP requests, and Load Balancing distributes traffic across origins.

Question 37Network Security

A customer wants Cloudflare to validate that connections to the origin come only from Cloudflare's edge without managing their own certificates. Which feature should they enable?

  1. Authenticated Origin Pulls with the Cloudflare-provided certificate Correct answer.
  2. Always Online
  3. Automatic HTTPS Rewrites
  4. Opportunistic Onion

Explanation

Authenticated Origin Pulls uses a Cloudflare-issued client certificate that the origin requires, ensuring only Cloudflare's edge can complete the TLS handshake. Always Online serves cached content during outages, Onion routing is unrelated, and Automatic HTTPS Rewrites adjusts page links.

Question 38Network Security

Which Cloudflare field would a rule author use to match requests based on the autonomous system number of the connecting client?

  1. http.referer
  2. cf.bot_management.score
  3. ip.geoip.asnum Correct answer.
  4. http.request.method

Explanation

The ip.geoip namespace exposes geographic and network attributes of the client IP, including asnum, which identifies the autonomous system. The referer and method fields describe the HTTP request, and the bot score reflects bot likelihood rather than network ownership.

Question 39Network Security

A team wants to protect an API endpoint so that requests must present a valid API key header, and requests without it are rejected at the edge. Which Cloudflare approach fits best?

  1. A WAF custom rule that blocks when the API key header is absent Correct answer.
  2. A cache rule that bypasses cache for the endpoint
  3. A DNS-only record for the API hostname
  4. A Page Rule that forwards the endpoint to a different host

Explanation

A custom rule can evaluate the presence and value of a header such as the API key and block requests that lack it before they reach the origin. Cache rules, DNS-only records, and forwarding Page Rules do not enforce credential presence.

Question 40Network Security

What is the effect of setting the zone's SSL/TLS mode to 'Flexible'?

  1. Traffic is encrypted end to end with strict certificate validation at the origin.
  2. Traffic is encrypted between the visitor and Cloudflare but sent to the origin over plain HTTP. Correct answer.
  3. All HTTP traffic is blocked at the edge.
  4. Traffic is encrypted only between Cloudflare and the origin.

Explanation

Flexible mode terminates TLS at the edge and connects to the origin over HTTP, which can expose the origin leg to interception. Full and Full (strict) encrypt the origin leg, with strict adding certificate validation; blocking all HTTP is a separate configuration.

Question 41Network Security

A customer wants to permit only requests from a defined set of source IP addresses to reach an administrative path. Which Cloudflare mechanism expresses this cleanly?

  1. A redirect rule that rewrites the path to the homepage
  2. A WAF custom rule that blocks the path unless ip.src is in a referenced IP list Correct answer.
  3. A cache rule that caches the administrative path
  4. A load balancer health check on the administrative path

Explanation

IP Lists can be referenced inside custom rule expressions, so a rule can allow only listed addresses and block the rest for that path. Cache rules, redirects, and health checks do not perform source-address authorization.

Question 42Network Security

Which statement best explains how Cloudflare's Bot Management score should be used in a firewall rule?

  1. It should replace TLS configuration for the zone.
  2. It should be used as a cache key so bots receive different cached content.
  3. It should be logged only and never referenced in rule expressions.
  4. It should be compared against a threshold to challenge or block likely automated traffic while allowing likely human traffic. Correct answer.

Explanation

The bot score expresses the likelihood that a request is automated, so rules typically compare it to a threshold and apply challenge or block actions. Using it as a cache key, replacing TLS settings, or forbidding its use in rules misstates its purpose.

Question 43Network Security

An analyst wants to review which requests were blocked by managed WAF rules over the past day. Which Cloudflare capability provides this?

  1. The SSL/TLS certificate list
  2. The cache purge interface
  3. Security Events in the dashboard or the GraphQL analytics API Correct answer.
  4. The DNS records page

Explanation

Security Events records firewall and WAF actions with request details, and the same data is available programmatically through the GraphQL analytics API. DNS, cache purge, and certificate pages do not report rule enforcement history.

Question 44Network Security

A customer enables a rate limiting rule with a counting characteristic of IP and a mitigation timeout, but legitimate users behind a shared corporate NAT are being blocked. What is the most appropriate adjustment?

  1. Change the action to Block with a longer timeout
  2. Disable the rule entirely and rely on the WAF
  3. Lower the threshold so fewer requests are counted
  4. Increase the threshold and add a counting characteristic such as a header or cookie that distinguishes users Correct answer.

Explanation

Shared egress IPs cause many distinct users to be counted together, so raising the threshold and adding a characteristic that separates users reduces false positives. Disabling protection, lengthening blocks, or lowering the threshold would worsen the impact on legitimate users.

Question 45Network Security

A rule expression blocks requests where 'http.host eq "www.example.com"' to stop an attack, but the zone also serves 'api.example.com' through the same configuration. What is the primary risk of this expression?

  1. It may block legitimate traffic to the named host while leaving the other hostname unaffected. Correct answer.
  2. It will block traffic to every hostname in the zone.
  3. It will disable TLS for the zone.
  4. It will cause the origin to reject Cloudflare connections.

Explanation

An equality test on http.host matches only the specified hostname, so the rule's effect is scoped to www.example.com and does not cover api.example.com. The risk is over-blocking on the matched host or leaving the other host unprotected, not a zone-wide block or TLS change.

Question 46Network Security

A team wants to roll out a new WAF custom rule safely. Which approach best limits the blast radius before full enforcement?

  1. Deploy the rule with a Log action first, review matched traffic, then switch to Block Correct answer.
  2. Deploy the rule with a very short rate limiting window
  3. Deploy the rule with Block and monitor user complaints
  4. Deploy the rule only in the development zone and never promote it

Explanation

Logging matches first lets the team validate the expression against real traffic and catch false positives before enforcement. Blocking immediately risks outages, keeping the rule only in development never protects production, and shortening a rate window does not test a custom rule's logic.

Question 47Network Security

An attacker rotates source IPs but reuses identical JA3 fingerprints and header ordering. Which Cloudflare capability is most useful for correlating these requests into a single enforcement decision?

  1. Cache Analytics reports
  2. Bot Management signals combined with custom rules referencing fingerprint and score fields Correct answer.
  3. DNS record proxying status
  4. Origin health checks

Explanation

Bot Management derives signals from TLS fingerprints, header order, and other client characteristics that persist across IP rotation, and custom rules can reference these fields. Cache reports, DNS proxying, and health checks do not correlate client behavior.

Question 48Network Security

A customer wants to allow only requests whose method is POST to a webhook path and block all other methods on that path. Which rule expression is correct in the Cloudflare Rules language?

  1. http.request.method eq "GET" and http.request.uri.path eq "/webhook"
  2. http.request.uri.path eq "/webhook" and http.request.method ne "POST" Correct answer.
  3. http.host eq "/webhook" and http.request.method ne "POST"
  4. http.request.uri.path eq "/webhook" or http.request.method eq "POST"

Explanation

The rule must match the webhook path and then identify requests whose method is not POST, which is what the block action should target. The other expressions use the wrong logical operator, target GET, or compare a hostname field to a path.

Question 49Network Security

What role does Cloudflare's Security Level setting play for a proxied zone?

  1. It adjusts the sensitivity of the challenge behavior applied to visitors based on threat signals. Correct answer.
  2. It sets the cache TTL for static assets.
  3. It determines which DNS records are proxied.
  4. It selects the TLS version used between Cloudflare and the origin.

Explanation

Security Level controls how aggressively Cloudflare challenges visitors, ranging from essentially off to challenging all visitors, based on assessed threat. TLS versions, DNS proxying, and cache TTLs are governed by separate settings.

Question 50Network Security

Which statement accurately describes the relationship between Cloudflare's WAF and its DDoS protection for HTTP attacks?

  1. DDoS mitigation handles volumetric and flood patterns, while the WAF evaluates request content against rules for application exploits. Correct answer.
  2. The WAF absorbs volumetric floods and the DDoS system inspects request bodies.
  3. Both systems only operate when Under Attack Mode is enabled.
  4. Both systems apply only to grey-clouded DNS records.

Explanation

DDoS mitigation focuses on absorbing and dropping attack traffic patterns such as floods, while the WAF inspects request content for exploit signatures and policy violations. Their roles are complementary and both operate on proxied traffic without requiring Under Attack Mode.