Cloudflare Network Security study plan
Cloudflare Network Security · Give each week a clear focus.
8 weeks · About 6 hours per week
Network Security
Map the full Cloudflare Network Security domain blueprint into a personal checklist of sub-topics, marking each as known, shaky, or unknown.
Define the shared-responsibility and traffic-path model: where DNS resolution, TLS termination, WAF inspection, and origin shielding sit relative to each other.
Set up a free Cloudflare account with one test zone and record the baseline security settings (SSL mode, proxy status, security level) before making changes.
Build a 6-hour weekly calendar block with two deep-work sessions and one review session.
Your checkpoint
A one-page domain checklist with every sub-topic rated known/shaky/unknown and a written weekly schedule.
Network Security
Explain how Cloudflare's anycast network routes a request and why that affects mitigation latency and regional behavior.
Configure DNS records for a test zone and observe how proxied versus DNS-only records change the security posture.
Compare SSL/TLS modes (Off, Flexible, Full, Full Strict) and predict the failure mode of each misconfiguration.
Enable Always Use HTTPS, HSTS, and minimum TLS version on the test zone and verify the resulting behavior with browser and command-line checks.
Your checkpoint
A configuration log documenting each DNS and TLS setting changed, the observed effect, and one misconfiguration you deliberately reproduced and fixed.
Network Security
Describe how the Cloudflare WAF evaluates requests and distinguish managed rulesets from custom rules.
Write custom firewall rules using expressions with fields such as IP, country, path, user agent, and threat score.
Configure rate limiting rules with thresholds, periods, and actions, then reason about false-positive risk for legitimate traffic.
Simulate blocked and allowed requests and confirm each rule fires as intended.
Your checkpoint
A rule set of at least five custom WAF rules and two rate-limiting rules, each with a written test case showing expected versus actual action.
Network Security
Differentiate bot management signals from simple user-agent checks and explain why signature-only filtering fails.
Configure a managed challenge versus a block versus a JavaScript challenge and justify each choice for a given traffic type.
Use security analytics to identify a top attack pattern in sample or simulated traffic and tune a rule in response.
Review logs and analytics dashboards to trace one request end to end through the security stack.
Your checkpoint
A written incident-style analysis of one simulated attack: traffic evidence, rule changes made, and before/after metrics.
Milestones
Week 4: Can explain the full request path from DNS to origin, justify every security setting on the test zone, and demonstrate at least five working WAF rules with test evidence.