I85PREP
⌘ K
Cloudflare Zero Trust study materials
Cloudflare Zero Trust study resources

Cloudflare Zero Trust practice questions

One question at a time. Build your Cloudflare Zero Trust understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ZTNA

In Cloudflare Zero Trust, what is the primary function of a Gateway DNS policy?

  1. It inspects and filters DNS queries made by enrolled devices before resolution. Correct answer.
  2. It assigns IP addresses to devices that join a Zero Trust organization.
  3. It replaces the device's configured DNS server with a local caching resolver.
  4. It encrypts all DNS traffic between the client and the nearest Cloudflare data center.

Explanation

Gateway DNS policies evaluate each DNS query against configured expressions and allow or block the query before the name is resolved, which prevents the device from learning the address of a blocked destination. They are enforcement rules, not transport encryption or address assignment.

Question 2ZTNA

Which Cloudflare One component runs on user devices to forward traffic to Cloudflare's network for policy enforcement?

  1. Cloudflare Tunnel
  2. WARP client Correct answer.
  3. Magic WAN
  4. Spectrum

Explanation

The WARP client is the device agent that enrolls a device into a Zero Trust organization and routes its traffic to Cloudflare, where Gateway applies HTTP, DNS, and network policies. Cloudflare Tunnel and Magic WAN connect networks and services rather than end-user devices.

Question 3ZTNA

What does a Cloudflare Access application policy ultimately determine?

  1. Which DNS record types are logged for a hostname.
  2. Which IP ranges are advertised into the customer's wide area network.
  3. Which TLS cipher suites the edge offers to browsers.
  4. Which users are permitted to reach a protected application after identity verification. Correct answer.

Explanation

An Access application wraps a protected resource, and its policies define the rules (such as identity, group, device posture, or location) that a user must satisfy to receive an authorization token. Routing, DNS logging, and cipher negotiation are separate concerns.

Question 4ZTNA

An administrator wants to protect a self-hosted web application without opening inbound firewall ports. Which Cloudflare Zero Trust approach fits best?

  1. Assign it a public IP address and restrict access with a Gateway DNS policy only.
  2. Add the hostname to a Magic WAN static route and rely on the origin firewall.
  3. Publish it through a Cloudflare Tunnel and place an Access application in front of it. Correct answer.
  4. Create a WARP enrollment rule and let users connect to the origin's private IP.

Explanation

A Cloudflare Tunnel uses outbound-only connections from a connector in the private network, so no inbound port is required, and Access then enforces identity-based authorization before the request reaches the origin. DNS filtering alone does not authenticate users or hide the origin.

Question 5ZTNA

Which statement describes the role of an identity provider in Cloudflare Access?

  1. It inspects outbound HTTP requests for malware signatures.
  2. It stores the private keys used to sign Cloudflare's edge certificates.
  3. It authenticates the user and returns identity claims that Access evaluates in policies. Correct answer.
  4. It resolves internal hostnames for WARP-enrolled devices.

Explanation

Access delegates authentication to an identity provider configured for the organization, then uses the returned claims such as email, group, or IdP groups when evaluating policies. Certificate signing, internal DNS resolution, and HTTP inspection are handled elsewhere.

Question 6ZTNA

What is the purpose of a device enrollment policy in Cloudflare Zero Trust?

  1. It defines how long Gateway retains DNS query logs.
  2. It defines which users may register a device with the organization and under what conditions. Correct answer.
  3. It defines which internal applications a device may reach after enrollment.
  4. It defines which TLS version the WARP client negotiates.

Explanation

Enrollment policies gate the act of joining a device to the Zero Trust organization, typically by email domain, identity provider group, or one-time PIN. Application authorization and logging retention are configured separately.

Question 7ZTNA

Which Gateway policy type would block a user from downloading a file from a known malicious URL over HTTPS?

  1. DNS policy
  2. Egress policy for Spectrum
  3. HTTP policy Correct answer.
  4. Network policy

Explanation

HTTP policies inspect the full request, including the host, path, and content, so they can block specific URLs or file downloads. DNS policies only see the queried name and network policies operate on layer 3 and 4 attributes.

Question 8ZTNA

What does the WARP client do with traffic when a user is connected to a Zero Trust organization with Gateway enabled?

  1. It forwards traffic to Cloudflare where policies are evaluated before the traffic continues. Correct answer.
  2. It sends all traffic directly to the destination and reports logs afterward.
  3. It routes traffic only through the local network gateway and never to Cloudflare.
  4. It blocks all traffic until an administrator manually approves each request.

Explanation

With Gateway enabled, the WARP client sends device traffic into Cloudflare's network so that HTTP, DNS, and network policies can be applied in line. Logging is a byproduct of that inspection rather than a post-hoc report.

Question 9ZTNA

A company wants employees to reach an internal wiki at wiki.internal without exposing it to the internet. They already run cloudflared in the data center. Which configuration makes the hostname resolvable and reachable for enrolled devices?

  1. Create a tunnel public hostname or private network route for wiki.internal and resolve it through Gateway. Correct answer.
  2. Add a Gateway DNS policy that allows wiki.internal and nothing else.
  3. Add wiki.internal to the organization's identity provider as a trusted origin.
  4. Create an Access service token and configure it on the wiki server.

Explanation

The tunnel must publish the hostname, either as a public hostname or as a private network route resolved through Gateway's resolver, so that enrolled devices can reach the origin. Access then enforces who may connect. A DNS allow policy alone does not create reachability.

Question 10ZTNA

An Access policy requires both a valid identity provider login and a healthy device posture check. What happens when a user authenticates successfully but their device fails the posture check?

  1. Access denies the request because all conditions in the policy must be satisfied. Correct answer.
  2. Access grants a token but Gateway blocks the session afterward.
  3. Access grants a token because identity was verified.
  4. Access redirects the user to the identity provider a second time.

Explanation

Policy rules are combined so that every required condition must evaluate true for the user to be authorized. A passing identity check cannot compensate for a failing posture check within the same rule.

Question 11ZTNA

Which Gateway expression best targets traffic to a specific SaaS application by its hostname while ignoring the path?

  1. dns.fqdn eq "app.example.com"
  2. http.request.uri.path eq "/login"
  3. net.dst.ip in {203.0.113.10}
  4. http.request.host in {"app.example.com"} Correct answer.

Explanation

The http.request.host field matches the hostname of an HTTP request, so a rule using it applies to all paths on that host. Path and IP fields would narrow or broaden the match in ways that do not isolate the hostname.

Question 12ZTNA

A security team wants to log which internal hostnames users attempt to resolve but must not block any of them. Which configuration achieves this?

  1. A Gateway network policy with the action Block on all internal ranges.
  2. A WARP profile that disables DNS logging for the organization.
  3. An Access application policy with a bypass rule for internal hostnames.
  4. A Gateway DNS policy with the action Allow and logging enabled for the matching traffic. Correct answer.

Explanation

An Allow action lets the query proceed while the request is still recorded in Gateway logs, giving visibility without enforcement. Blocking would prevent resolution, and Access governs application authorization rather than DNS visibility.

Question 13ZTNA

What distinguishes a Cloudflare Access service token from a user identity in an Access policy?

  1. Service tokens are used by non-human clients and are validated by client ID and secret headers. Correct answer.
  2. Service tokens are issued to users after they complete a one-time PIN challenge.
  3. Service tokens replace the identity provider for all browser-based logins.
  4. Service tokens are stored on the WARP client and rotated by the device.

Explanation

Service tokens let machine-to-machine clients authenticate to Access by presenting a client ID and client secret, and policies can include them as a rule. They do not substitute for interactive user authentication through an identity provider.

Question 14ZTNA

An administrator wants only devices with disk encryption enabled to reach a finance application, regardless of user identity. Which Access configuration element should be used?

  1. A WARP enrollment rule restricted to the finance email domain.
  2. A Gateway DNS policy blocking non-finance hostnames.
  3. A device posture check included as a policy requirement. Correct answer.
  4. An identity provider group mapped to the finance department.

Explanation

Device posture checks report attributes such as disk encryption, and including one as a policy requirement enforces that condition independently of who the user is. Group membership and enrollment rules act on identity or onboarding rather than device state.

Question 15ZTNA

Which statement about Cloudflare Tunnel connectors is accurate?

  1. They require a public IP address and an inbound allow rule on port 443.
  2. They replace the need for Access policies on published hostnames.
  3. They must be deployed on the same host as the protected application.
  4. They establish outbound connections to Cloudflare and need no inbound firewall openings. Correct answer.

Explanation

A tunnel connector dials out to Cloudflare, so the private network needs no inbound exposure, and requests are delivered over that established connection. Access policies remain necessary to authorize users reaching the published hostname.

Question 16ZTNA

A Gateway HTTP policy blocks a category of sites, but a small group of administrators must reach those sites for troubleshooting. How should the configuration be structured?

  1. Disable the Block policy for the whole organization during troubleshooting.
  2. Add the administrators to a DNS policy that overrides the HTTP block.
  3. Create an Access application for the blocked sites with a bypass rule.
  4. Add an Allow policy ordered before the Block policy that matches the administrator group. Correct answer.

Explanation

Gateway evaluates policies in order and stops at the first match, so placing a narrower Allow rule above the broader Block rule lets the administrators through while everyone else still hits the block. Disabling the block or using a DNS rule would not produce the same scoped result.

Question 17ZTNA

Which outcome results from configuring a Gateway network policy that blocks a destination IP range for a device?

  1. HTTP requests to that range are inspected for malware.
  2. The device loses its WARP enrollment until the policy is removed.
  3. Connections to addresses in that range are dropped at the network layer for that device. Correct answer.
  4. DNS queries for hostnames in that range are refused before resolution.

Explanation

Network policies act on layer 3 and 4 attributes such as destination IP, port, and protocol, so matching connections are blocked at that layer. DNS and HTTP policies operate at different layers and are configured separately.

Question 18ZTNA

A user reports being asked to authenticate to Access repeatedly for the same application throughout the day. Which setting is most relevant to investigate?

  1. The Gateway DNS log retention period.
  2. The Access application session duration. Correct answer.
  3. The WARP client's DNS resolver address.
  4. The tunnel connector's replica count.

Explanation

Access issues a session token whose lifetime is governed by the application session duration; a short value causes frequent re-authentication. Log retention, resolver address, and connector replicas do not control how long an authorization session lasts.

Question 19ZTNA

Which Cloudflare Zero Trust feature provides a private IP address to each enrolled device so it can reach internal resources through Cloudflare?

  1. Access service tokens
  2. Gateway HTTP policies
  3. Cloudflare Tunnel public hostnames
  4. WARP assigned private network addressing Correct answer.

Explanation

WARP can assign devices addresses within a private network range that Cloudflare routes, allowing them to reach internal resources through the tunnel. Service tokens, HTTP policies, and public hostnames serve different purposes.

Question 20ZTNA

An organization wants to inspect traffic to a legacy application that uses a non-standard TCP port and cannot be proxied at the HTTP layer. Which Gateway capability is most appropriate?

  1. A network policy that evaluates destination IP, port, and protocol. Correct answer.
  2. A DNS policy that blocks the application's hostname.
  3. An HTTP policy that matches the request path.
  4. An Access application policy using a one-time PIN.

Explanation

Network policies operate on layer 3 and 4 attributes, including destination port and protocol, which suits non-HTTP traffic. HTTP policies require HTTP semantics, and DNS policies only see the queried name.

Question 21ZTNA

A company wants to allow access to an internal application only from a specific country while still requiring identity authentication. How should this be modeled in Access?

  1. Use a WARP enrollment rule for the country and skip Access policies.
  2. Include a country-based requirement and an identity requirement in the same Access policy rule. Correct answer.
  3. Use a Gateway DNS policy for the country and rely on Access for identity only.
  4. Create two separate applications, one for the country and one for identity.

Explanation

Multiple requirements can be combined within an Access policy rule so that the user must satisfy all of them, covering both location and identity. Splitting across applications or relying on DNS or enrollment does not enforce both conditions on the same request.

Question 22ZTNA

Which behavior is expected when a Gateway HTTP policy with the action Isolate matches a request?

  1. The user browses the site in a remote browser session separated from the local device. Correct answer.
  2. The request is dropped and the user sees a block page.
  3. The request is allowed and only logged for later review.
  4. The hostname is refused at DNS resolution.

Explanation

Isolation renders the site in a remote browser hosted by Cloudflare, so risky content never executes on the local device while the user can still interact with the page. Blocking, DNS refusal, and passive logging are distinct actions.

Question 23ZTNA

An administrator needs Gateway to evaluate a request against both an HTTP policy set and a DNS policy set. Which statement about how these policy types interact is correct?

  1. HTTP policies override DNS policies, so a DNS block is ignored once an HTTP allow matches.
  2. DNS policies act on the resolution step and HTTP policies act on the request itself, so both can affect the same user session. Correct answer.
  3. Only one Gateway policy type can be active per device at a time.
  4. DNS policies are evaluated only when HTTP policies produce no match.

Explanation

DNS and HTTP filtering occur at different stages of a connection: the name must resolve before an HTTP request can be made, and each stage has its own policy set. A DNS block prevents the connection from forming, while HTTP policies govern requests that do reach the proxy.

Question 24ZTNA

A team publishes an internal application through a tunnel and an Access application, but users can still reach the origin directly by IP from inside the office network. What is the most effective Zero Trust remediation?

  1. Add more tunnel connector replicas to improve availability.
  2. Restrict origin access at the network layer so only the tunnel connector can reach it, and require Access for user entry. Correct answer.
  3. Add a Gateway DNS block for the origin IP address on all devices.
  4. Increase the Access session duration so users stay authenticated longer.

Explanation

Bypass paths undermine Access because authorization is skipped when the origin is reachable directly. Closing the origin to everything except the connector, combined with Access for users, ensures all entry points are mediated by Zero Trust controls.

Question 25ZTNA

An Access policy contains two rules in the same policy: Rule A allows the engineering group, and Rule B allows users with a compliant device. How are these rules combined?

  1. The user must satisfy both rules, because rules within a policy are cumulative.
  2. Only the first matching rule is evaluated and the second is ignored.
  3. Neither rule applies until an administrator manually approves the request.
  4. The user is authorized if either rule evaluates true, because rules within a policy are alternatives. Correct answer.

Explanation

Within a single Access policy, rules act as alternative paths to authorization, so a user who satisfies any one rule is granted access, while the policy as a whole must still be satisfied. Requirements that must all hold are combined inside one rule using AND logic.

Question 26ZTNA

In Cloudflare Zero Trust, which component acts as the policy enforcement point for DNS, network, and HTTP traffic leaving an enrolled device?

  1. Cloudflare Access
  2. Cloudflare Tunnel
  3. Cloudflare WAF
  4. Cloudflare Gateway Correct answer.

Explanation

Gateway is the secure web gateway component that inspects and applies policies to DNS, network, and HTTP traffic from enrolled devices. Access governs application authentication, Tunnel publishes origins, and WAF protects public web properties, so Gateway is the enforcement layer for egress traffic.

Question 27ZTNA

Which Cloudflare Zero Trust construct is used to group users so that policies can reference them collectively rather than listing each identity?

  1. Tunnel routes
  2. Device profiles
  3. Service tokens
  4. Access groups Correct answer.

Explanation

Access groups are named collections of users, email domains, or identity provider groups that policies can reference by name. This keeps policies readable and lets membership change without editing every rule. Service tokens authenticate machines, tunnel routes map hostnames, and device profiles configure WARP settings.

Question 28ZTNA

Which identity provider capability is required for Cloudflare Access to receive group membership claims that policies can evaluate?

  1. The IdP must support SAML single logout only
  2. The IdP must be the same vendor as the Cloudflare account owner
  3. The IdP must issue client certificates to each user
  4. The IdP must be configured with the appropriate scopes and group claims in the Access integration Correct answer.

Explanation

Access relies on claims returned by the identity provider, so the integration must request scopes and expose group or role claims that Access can map. Without those claims, policies referencing groups cannot be evaluated. Single logout, vendor alignment, and client certificates are unrelated to claim delivery.

Question 29ZTNA

An administrator wants Access to require a second factor for a sensitive application even when the identity provider marks the login as password-only. Which configuration achieves this?

  1. Disable the identity provider integration for the account
  2. Add a require rule for a specific authentication method such as a one-time PIN or hardware key in the Access policy Correct answer.
  3. Enable Gateway antivirus scanning for the application hostname
  4. Add a bypass rule for the application for trusted networks

Explanation

Access policies can require particular authentication methods, so adding a require rule for a stronger method forces the second factor at the Access layer. Gateway scanning and bypass rules do not strengthen authentication, and removing the IdP would break login entirely.

Question 30ZTNA

What is the effect of an Access application configured with a self-hosted application type and no policies attached?

  1. No user can pass authorization because no policy grants access Correct answer.
  2. All users in the organization are allowed by default
  3. Only service tokens are allowed
  4. Access falls back to Gateway HTTP policies

Explanation

Access evaluates policies to decide whether a request is allowed, and with no policy present there is nothing that grants access, so requests are denied. There is no implicit allow for organization members, and Gateway policies are a separate enforcement layer.

Question 31ZTNA

Which statement describes how Cloudflare WARP handles DNS resolution for an enrolled device in a Zero Trust organization with Gateway DNS logging enabled?

  1. DNS queries are sent to a Cloudflare resolver that applies Gateway DNS policies and logs the results Correct answer.
  2. DNS queries are resolved by the tunnel connector on the origin network
  3. DNS queries are blocked entirely until an HTTP policy matches
  4. DNS queries bypass Cloudflare and are resolved by the local ISP resolver only

Explanation

When WARP is enrolled and DNS logging is enabled, device DNS queries go to Cloudflare resolvers where Gateway DNS policies are evaluated and results are logged. Local resolvers and origin-side resolution are not used in that configuration.

Question 32ZTNA

A Gateway DNS policy blocks a domain, but users report the site still loads. Which explanation is most likely?

  1. The DNS policy was applied to the wrong account region
  2. Gateway DNS policies only apply to IPv6 queries
  3. The device is resolving the domain through a channel that bypasses Gateway DNS, such as a hardcoded resolver or DoH Correct answer.
  4. The domain is on the Gateway allow list by default

Explanation

DNS filtering only works when queries actually reach Cloudflare resolvers, so applications using their own encrypted DNS or hardcoded resolvers can evade the policy. Default allow lists, region misplacement, and IPv6-only scope are not standard explanations for this behavior.

Question 33ZTNA

Which Cloudflare Zero Trust capability lets an administrator publish an internal web application to remote users without opening inbound firewall ports?

  1. An inbound NAT rule on the perimeter firewall
  2. Cloudflare Tunnel with a public hostname routed to the Access application Correct answer.
  3. A static public IP address attached to the origin server
  4. A site-to-site IPsec tunnel to the Cloudflare edge

Explanation

Cloudflare Tunnel establishes outbound-only connections from a connector to the Cloudflare edge, so internal applications can be published without inbound ports. IPsec site-to-site links, static public IPs, and inbound NAT all require exposing the network edge.

Question 34ZTNA

A Cloudflare Tunnel is configured with two connectors for redundancy. What happens if one connector stops running?

  1. Access policies are automatically disabled
  2. All requests fail until the stopped connector returns
  3. Traffic is served by the remaining connector with minimal disruption Correct answer.
  4. The tunnel is deleted and must be recreated

Explanation

Multiple connectors for the same tunnel provide high availability, so the remaining connector continues serving requests when one fails. The tunnel persists, requests do not fail outright, and Access policies are unaffected by connector state.

Question 35ZTNA

Which device posture attribute would an Access policy use to confirm that an endpoint is running an approved operating system version?

  1. The OS version check reported by the WARP client or device client integration Correct answer.
  2. The user's email domain
  3. The source IP address of the request
  4. The browser user agent string

Explanation

Device posture attributes come from the WARP client or integrated endpoint providers and include checks such as OS version. Email domain, IP address, and user agent describe identity or network context rather than the device's operating system state.

Question 36ZTNA

An Access policy requires a device posture check, but a user's WARP client is signed out. What is the expected result when the user opens the protected application?

  1. Access redirects the user to Gateway for HTTP inspection
  2. Access allows the request because identity was already verified
  3. Access creates a service token automatically
  4. Access denies the request because the posture check cannot be satisfied Correct answer.

Explanation

Posture checks are reported by the enrolled client, so a signed-out WARP client cannot supply the required attestation and the policy fails. Identity verification alone does not satisfy a posture requirement, and Access does not substitute Gateway inspection or issue tokens.

Question 37ZTNA

Which Gateway policy action allows a request while still recording it in the logs?

  1. Isolate
  2. Block
  3. Allow Correct answer.
  4. Bypass

Explanation

The Allow action permits the request and still produces a log entry, which supports auditing and troubleshooting. Block denies the request, Isolate redirects browsing into a remote browser, and Bypass skips further inspection without the same logging semantics.

Question 38ZTNA

Which Gateway policy selector would target traffic based on the category assigned by Cloudflare's threat intelligence rather than an explicit hostname list?

  1. Content category or security category selectors Correct answer.
  2. Identity group selectors
  3. Source IP address selectors
  4. Destination IP range selectors

Explanation

Category selectors match destinations according to Cloudflare's classification, including security categories such as malware or phishing. IP range, source IP, and identity selectors match network or user attributes rather than content classification.

Question 39ZTNA

What does the Gateway Isolate action do when a user navigates to a matching site?

  1. It blocks the site and displays a block page
  2. It loads the site in a remote browser session so content executes away from the endpoint Correct answer.
  3. It rewrites the site's TLS certificate
  4. It caches the site content on the Cloudflare edge

Explanation

Isolate renders the site in an isolated remote browser, so potentially risky content runs away from the user's device. It does not block the site, cache content for offline use, or reissue certificates as its primary function.

Question 40ZTNA

A Gateway HTTP policy and a Gateway DNS policy both match the same request. Which statement best describes their relationship?

  1. Only the HTTP policy is evaluated because it is more specific
  2. Only the DNS policy is evaluated once an HTTP policy exists
  3. Both layers evaluate independently, and a block at either layer can prevent the connection Correct answer.
  4. The two policies are merged into a single decision by the connector

Explanation

Gateway evaluates DNS and HTTP as separate policy layers, so a block at the DNS layer stops resolution before an HTTP request is made, while an HTTP block stops the request itself. Neither layer disables the other, and connectors do not merge policy decisions.

Question 41ZTNA

Which Cloudflare Zero Trust feature allows administrators to define which users may reach an application based on their identity provider group, without writing per-user rules?

  1. A Gateway network policy referencing a destination IP
  2. An Access policy rule referencing an IdP group Correct answer.
  3. A tunnel route referencing a hostname
  4. A WARP profile referencing a split tunnel list

Explanation

Access policies can include rules that match identity provider groups, so all members of the group are covered by one rule. Gateway network policies, tunnel routes, and split tunnel lists control traffic paths rather than user authorization by group.

Question 42ZTNA

An administrator wants to test an Access policy change for a new application without affecting production users. Which approach best limits the impact?

  1. Remove all policies and rely on Gateway HTTP filtering
  2. Disable the identity provider for all applications during the test
  3. Apply the policy to the entire organization and monitor logs afterward
  4. Create the application with a policy scoped to a pilot group and verify before broadening it Correct answer.

Explanation

Scoping the new application's policy to a pilot group lets the administrator validate behavior with limited exposure before widening access. Disabling the IdP or removing policies would disrupt or weaken production access, and applying changes organization-wide first defeats the purpose of testing.

Question 43ZTNA

Which statement accurately describes how Access handles a request from a user who has a valid session but whose group membership was removed from the identity provider?

  1. Access continues to allow access until the user manually signs out
  2. Access permanently caches the original group membership for the account
  3. Access re-evaluates the identity claims and denies access once the session reflects the updated membership Correct answer.
  4. Access converts the user into a service token

Explanation

Access bases authorization on identity claims, so when group membership changes and the session is refreshed, the policy no longer matches and access is denied. Access does not grant indefinite access based on stale membership, cache membership permanently, or convert users into service tokens.

Question 44ZTNA

Which Cloudflare Zero Trust component provides a private network address to enrolled devices so they can reach internal IP ranges through Cloudflare?

  1. WARP client with a configured private network route in the tunnel Correct answer.
  2. Gateway DNS policy
  3. Access service token
  4. Browser isolation session

Explanation

The WARP client, combined with private network routes advertised through a tunnel, lets enrolled devices reach internal IP ranges without a traditional VPN. Service tokens, DNS policies, and isolation sessions do not assign private network reachability.

Question 45ZTNA

An organization wants to route only traffic destined for 10.0.0.0/8 through WARP while sending all other traffic directly to the internet. Which configuration accomplishes this?

  1. A Gateway HTTP policy that blocks all other traffic
  2. A tunnel route that advertises 0.0.0.0/0 to clients
  3. A split tunnel configuration that includes the private range and excludes the rest Correct answer.
  4. An Access policy that requires device posture for all users

Explanation

Split tunneling determines which traffic the WARP client sends through Cloudflare, so including 10.0.0.0/8 and excluding other destinations achieves the goal. Blocking policies, posture requirements, and a default route would either disrupt traffic or send everything through the tunnel.

Question 46ZTNA

Which log source in Cloudflare Zero Trust would an administrator review to see which internal hostnames a device attempted to resolve?

  1. Gateway DNS logs Correct answer.
  2. Tunnel connector logs
  3. Access audit logs
  4. WAF event logs

Explanation

Gateway DNS logs record the queries devices send through Cloudflare resolvers, including the hostnames attempted. Access audit logs cover authentication and authorization events, connector logs cover tunnel health, and WAF logs cover inbound web requests.

Question 47ZTNA

A security team wants to block access to newly registered domains while allowing established sites. Which Gateway control best matches this requirement?

  1. A source IP selector for the corporate office
  2. An identity group selector for contractors
  3. A security category selector for newly registered domains with a Block action Correct answer.
  4. A destination IP range selector for the site's CDN

Explanation

Cloudflare classifies domains by security category, including newly registered domains, so a category-based Block rule matches the requirement directly. IP range, source IP, and identity selectors describe network or user attributes rather than domain age classification.

Question 48ZTNA

Which condition must be true for a Cloudflare Tunnel connector to serve traffic for a configured public hostname?

  1. The connector must be running and connected to the Cloudflare edge for that tunnel Correct answer.
  2. The hostname must resolve to the connector's local address
  3. The origin must have a public IP address reachable from the internet
  4. The Access application must be disabled

Explanation

A tunnel only serves traffic while at least one connector for that tunnel maintains a connection to the Cloudflare edge. The origin does not need a public IP, the hostname resolves to Cloudflare rather than the connector, and Access can remain enabled.

Question 49ZTNA

An administrator wants to enforce that only managed devices can reach an internal application, regardless of which user account is used. Which policy design meets this requirement?

  1. A require rule for a managed device posture check in the Access policy Correct answer.
  2. A Gateway DNS block for unmanaged device hostnames
  3. An allow rule for every user in the identity provider
  4. A bypass rule for the application on trusted networks

Explanation

A require rule on a managed-device posture check ensures access depends on device state rather than user identity alone. Allowing every user, blocking DNS names, or bypassing Access would not enforce the managed-device condition.

Question 50ZTNA

Which outcome occurs when a Gateway network policy blocks a destination IP range for an enrolled device using WARP?

  1. Connections from the device to addresses in that range are dropped at the Cloudflare edge Correct answer.
  2. The device loses all internet connectivity until WARP is restarted
  3. The destination server is blocked for every Cloudflare customer
  4. The policy applies only to DNS queries for that range

Explanation

Network policies act on L4 traffic from the enrolled device, so connections to addresses in the blocked range are dropped while other traffic continues. The block is scoped to the organization's devices, does not disable WARP globally, and is distinct from DNS policy behavior.