I85PREP
⌘ K
Cloudflare Zero Trust study materials
Cloudflare Zero Trust study resources

Cloudflare Zero Trust: DEX: endpoint telemetry, synthetic tests, and layered troubleshooting

Cloudflare Zero Trust · Work through your exam, one topic at a time.

All guide sections

DEX: endpoint telemetry, synthetic tests, and layered troubleshooting

DEX (Digital Experience Monitoring)

DEX items test whether you can prove where a user's problem lives: the device, the local network, the ISP, or the application. Cloudflare DEX gathers telemetry from WARP-enrolled endpoints and adds on-demand and scheduled tests, so answers usually hinge on which data source actually contains the evidence.

What DEX provides

  • Endpoint health: CPU, memory, disk, battery, OS build, WARP client version, network interface details, and WARP and Gateway status.
  • Fleet views: filter by user, group, OS, WARP version, or location. This is how you spot a cohort-shaped problem after a client rollout.
  • Live diagnostics: run traceroute or MTR and HTTP checks from one device while the user is on the call.
  • Scheduled tests: recurring HTTP checks with an expected response, plus path tests, executed across the fleet; results give latency and hop-level detail over time.
  • Alerts: notify on device metric thresholds and test failures through Cloudflare Notifications to email, webhook, or PagerDuty.
  • Outage context: correlate with internet outage data so you do not debug an application that is healthy while the ISP is down.

Worked example

Complaint: the CRM is slow for roughly 40 percent of the London office.

  1. Filter the fleet to London CRM users and compare WARP and OS versions; a recent client update would explain a cohort pattern.
  2. Compare CPU and memory on affected versus unaffected devices to rule out endpoint contention.
  3. Run a live traceroute from one affected device and compare it with a working user in another office.
  4. Compare scheduled HTTP test latency for the CRM host against its 24-hour baseline.
  5. If hops degrade at the ISP boundary, escalate as a network fault; if only authenticated application calls fail, pivot to Gateway HTTP logs.

Reasoning: each step eliminates one layer, so you never ship a device fix for a routing problem.

Traps

  • Expecting coverage for unmanaged or not-yet-enrolled devices; no WARP means no telemetry.
  • Treating DEX as a substitute for Gateway logs or application APM; DEX explains the path, not the request decision.
  • Scheduling tests against endpoints that demand interactive SSO, then chasing false failures.
  • Ignoring WARP version skew when results cluster by device cohort.
  • Skipping privacy review before enabling detailed endpoint metrics fleet-wide.