Cloudflare Zero Trust flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Access policy default decision

If a request matches no Access policy on an application, Access denies it. Every application must have at least one Allow policy with an Include rule to admit users.

Include versus Require rules

Include admits identities that match any listed criterion. Require adds mandatory conditions on top of an Include match. A policy with only Require rules cannot admit anyone.

Access service tokens

Non-interactive credentials used by automated clients. The client sends CF-Access-Client-Id and CF-Access-Client-Secret headers, and Access validates them instead of an identity provider login.

Access JWT session cookie

After login, Access sets a signed application-scoped cookie. Session duration and re-authentication settings control how long it remains valid before the user must authenticate again.

Exclude rule precedence

An Exclude rule overrides any Include match, so listed identities are denied even if another criterion would admit them. Use Exclude to carve out blocked users or groups.

Bypass policy behavior

A Bypass policy skips identity authentication entirely for matching requests. It is typically reserved for public assets, health checks, or endpoints that cannot complete an IdP flow.

WARP-to-Tunnel private routing

Cloudflared publishes internal CIDR ranges to Cloudflare. Enrolled devices connected through WARP resolve and reach those private IPs without a traditional VPN concentrator.

Device posture checks

Access can require WARP client signals such as OS version, disk encryption, or running processes before granting a session. Failing posture blocks the login at the policy stage.

Gateway policy evaluation order

Gateway evaluates DNS policies first, then network policies, then HTTP policies. Within each category the first matching rule applies; unmatched traffic falls to the default allow.

DNS filtering block response

When a DNS policy blocks a hostname, Gateway returns 0.0.0.0 or the block page address. The connection never opens, so no TCP handshake or HTTP request occurs.

TLS decryption prerequisites

Gateway decrypts HTTPS only when a decryption policy matches and the endpoint trusts the Cloudflare certificate. Without that trust, users receive certificate warnings and inspection fails.

Do Not Inspect list

Hostnames or categories exempted from TLS inspection for privacy or compatibility. DNI traffic still passes through DNS and network policies but content is not decrypted or scanned.

Gateway HTTP policy selectors

HTTP rules can match URL, host, URL category, application, HTTP method, user identity, source IP, and device posture. Multiple selectors combine as AND within one rule.

Remote Browser Isolation

Gateway routes matching sites through a cloud browser and streams only pixels to the endpoint. Downloads, clipboard, and printing are controlled by separate isolation settings.

Cloudflare Gateway categories

Curated intelligence feeds classifying domains by content or risk, such as Security Risks or Gambling. Policies can allow or block entire categories instead of individual hostnames.

Network location egress

Devices without WARP can send DNS over HTTPS to a unique subdomain and route traffic through dedicated egress IPs, letting Gateway apply policies by network location.

Gateway Logpush fields

DNS, network, and HTTP logs record timestamp, user, device, host, action, and policy name. Unmatched requests appear as allowed, which helps identify policy gaps.

DEX synthetic application tests

Administrators schedule HTTP, TCP, or traceroute probes against target URLs from selected device cohorts. Results report latency, status codes, and hop-by-hop network path data.

DEX experience score

An aggregated measure combining device health, network quality, and application reachability for a user or fleet. Lower scores point to degraded endpoints, paths, or apps.

DEX device telemetry

The WARP client reports CPU, memory, disk, battery, OS version, and WARP connection state. These signals feed troubleshooting views and can back device posture checks.

Last-mile network path

DEX identifies the ISP, local gateway, and Cloudflare colo a device reaches. Comparing hops separates local Wi-Fi or ISP faults from Cloudflare-side problems.

DEX troubleshooting workflow

Start from the affected user or device, review the experience score, inspect synthetic test results, then examine the network path before escalating to support.

DEX enrollment dependency

DEX collects data only from devices running the WARP client. Devices without WARP produce no telemetry, so monitoring gaps usually indicate incomplete deployment.

Private app reachability tests

Synthetic tests can target internal applications reached through Tunnel. Failures often correlate with Tunnel health, Gateway policy blocks, or identity provider outages.

API CASB out-of-band scanning

Cloudflare connects to SaaS tenants through OAuth and scans stored data for oversharing, misconfiguration, and risky third-party grants without sitting inline in the traffic path.

Inline CASB controls

Gateway HTTP policies act on SaaS traffic in real time, applying actions such as block upload, block download, or require justification on matched applications.

Shadow IT discovery

Gateway logs reveal unsanctioned SaaS applications in use. Each app receives a risk score based on category, security posture, and observed usage volume.

DLP profile entries

A DLP profile contains detection entries: predefined patterns for PII or financial data, custom regex, keywords, and document fingerprints, each with a confidence threshold.

DLP policy actions

DLP policies apply Allow, Block, or Block with override. Overrides require the user to enter a justification, which is logged for later audit and review.

DLP and TLS inspection

DLP inspects content only in traffic it can read. Encrypted sessions excluded from TLS decryption are not scanned, so DLP coverage depends on decryption policy.

API CASB remediation actions

Findings such as public file links or risky OAuth grants can be remediated from Cloudflare by revoking sharing, removing app access, or notifying the file owner.

DLP match logging

Every DLP match generates a Gateway or CASB log entry with the profile, rule, user, and action. Optional notifications alert administrators, and overrides record stated reasons.