Cloudflare Zero Trust study guide
Cloudflare Zero Trust · Work through your exam, one topic at a time.
The Cloudflare Zero Trust exam validates practical knowledge of Cloudflare's Zero Trust platform, which combines ZTNA, SWG, DEX, and CASB & DLP capabilities on a single global network. This independent study guide is designed for security engineers, network architects, and IT administrators who are implementing or evaluating Zero Trust architectures and want to demonstrate competence with Cloudflare's approach. The exam covers four domains, each weighted at 25%: ZTNA (identity-aware access that retires VPNs), SWG (secure web gateway controls for internet traffic), DEX (digital experience monitoring for users and devices), and CASB & DLP (cloud access security broker and data loss prevention). Questions test your ability to configure policies, troubleshoot access issues, and apply Zero Trust principles in real-world scenarios. The Cloudflare Zero Trust study guide has 4 sections and about 1,795 words.
01ZTNA: Cloudflare Access policy design, tunnels, and machine identity
The ZTNA domain is tested through Access : how identity and device signals become a per-application authorization decision, how traffic reaches the app, and how non-human clients authenticate. Expect policy-writing items where several answers look reasonable and only one has the correct action, selector logic, and origin lockdown.
459 words, about 2 min02SWG: Cloudflare Gateway policy layers, TLS inspection, and rule order
The SWG domain tests Gateway : which layer can see which attribute, how user identity reaches a DNS or HTTP decision, when TLS inspection is mandatory, and how first-match ordering changes the result. Most items are decided by one detail: the layer or the order.
449 words, about 2 min03DEX: endpoint telemetry, synthetic tests, and layered troubleshooting
DEX items test whether you can prove where a user's problem lives: the device, the local network, the ISP, or the application. Cloudflare DEX gathers telemetry from WARP-enrolled endpoints and adds on-demand and scheduled tests, so answers usually hinge on which data source actually contains the evidence.
451 words, about 2 min04CASB and DLP: out-of-band findings versus inline content enforcement
This domain separates out-of-band discovery from inline content control. The exam wants you to know which product can see which data, whether it acts in real time, and where enforcement actually happens.
436 words, about 2 min