I85PREP
⌘ K
Cloudflare Network Security study materials
Cloudflare Network Security study resources

Cloudflare Network Security: Network Security

Cloudflare Network Security · Work through your exam, one topic at a time.

All guide sections

Network Security

Domain focus

The Network Security domain tests how Cloudflare's edge enforces security at layers 3, 4, and 7. You must choose the right product for the threat, understand evaluation order, and configure rules that neither over-block nor leave gaps. Expect questions on proxying, DDoS, WAF, rate limiting, TLS, and origin protection.

Core rules and concepts

  • Proxy status decides coverage. Only DNS records proxied through Cloudflare (orange cloud) receive WAF, DDoS, and TLS edge features. Grey-clouded records resolve directly to origin and bypass them.
  • DDoS is layered. Cloudflare mitigates L3/4 volumetric attacks automatically for proxied hostnames and Magic Transit customers. L7 attacks need WAF custom rules, rate limiting, and Bot Management. Spectrum extends L4 proxy protection to arbitrary TCP/UDP.
  • WAF rule order matters. Custom rules evaluate before managed rules; within custom rules, order by priority. Use Skip actions to exempt trusted traffic from later managed rules. Managed rulesets (Cloudflare Managed, OWASP) cover known signatures but not business logic.
  • Rate limiting is behavioral. It counts requests per client over a period, keyed by IP or headers, and applies block, challenge, or JS challenge. Use it for brute force and scraping, not volumetric floods.
  • TLS must be end-to-end. Flexible mode terminates TLS at the edge and talks HTTP to origin, so it is not secure. Use Full (strict) with a valid origin certificate. Enable Always Use HTTPS, HSTS, and a minimum TLS version.
  • Protect the origin. Authenticated Origin Pulls uses mTLS; Cloudflare Tunnel avoids exposed IPs; firewall allowlists should permit only Cloudflare IP ranges.

Worked example

A team wants to block country XX but keep /api/* open, and challenge requests to /login from a bad ASN. Write custom rules in order: (1) Skip for ip.geoip.country eq "XX" and starts_with(http.request.uri.path, "/api"); (2) Block for ip.geoip.country eq "XX"; (3) Challenge for ip.geoip.asnum in {64500} and http.request.uri.path eq "/login". The Skip must come first, or the block would catch API traffic. The challenge is narrow, so it does not affect other paths.

Traps that cost marks

  • Treating a grey-cloud record as protected.
  • Calling Flexible SSL "encrypted to origin."
  • Using rate limiting for a volumetric DDoS.
  • Putting a broad Block before a specific Skip.
  • Confusing Magic Transit (network-range BGP protection) with Spectrum (TCP/UDP application proxy) and WAF (HTTP).