I85PREP
⌘ K
Cloudflare Zero Trust study materials
Cloudflare Zero Trust study resources

Cloudflare Zero Trust: CASB and DLP: out-of-band findings versus inline content enforcement

Cloudflare Zero Trust · Work through your exam, one topic at a time.

All guide sections

CASB and DLP: out-of-band findings versus inline content enforcement

CASB and DLP

This domain separates out-of-band discovery from inline content control. The exam wants you to know which product can see which data, whether it acts in real time, and where enforcement actually happens.

Cloudflare CASB

  • API-based and out-of-band: you authorize Cloudflare against SaaS tenants such as Microsoft 365, Google Workspace, Salesforce, Box, Dropbox, GitHub, Slack, Atlassian, and ServiceNow, then scans run on a schedule.
  • Finding categories include misconfiguration (public links, weak MFA), data exposure, user access and privilege problems, shadow IT, and third-party app risk.
  • Severity drives triage. Remediation happens in the SaaS console, or inline by blocking the app through Gateway.
  • CASB observes; it is not in the request path, so it is not real time and cannot stop a transfer already in flight.

Cloudflare DLP

  • Profiles contain detection entries: predefined sets (credentials, financial data, PII, PHI), custom regular expressions, keyword lists, and document fingerprints for exact-data-match against source files.
  • Enforcement is a Gateway HTTP policy referencing a DLP profile, usually filtered by method such as POST or PUT, by host, and by file type. HTTPS bodies need TLS inspection; uninspected traffic yields no detection.
  • Actions are Block, Allow with logging, or Isolate, and logs record which profile matched.

Worked example

Requirement: stop customer SSNs leaving through web uploads while letting HR upload to the HR platform.

  1. Build a custom DLP profile: SSN pattern plus a minimum match count to cut noise.
  2. HTTP policy 1: Allow host hr-platform.example.
  3. HTTP policy 2: Block POST and PUT with the SSN profile.
  4. Confirm TLS inspection is active for those destinations and excluded only where genuinely needed.

Reasoning: the exception precedes the block because Gateway is first-match; the rule targets upload methods rather than all traffic so browsing still works; the match count prevents one incidental number in a page body from triggering a block.

Traps

  • Expecting DLP to inspect HTTPS with inspection disabled.
  • Treating CASB findings as a real-time block.
  • Assuming CASB covers SaaS apps that were never integrated.
  • Forgetting that document fingerprints need representative source documents.
  • Blocking all methods instead of upload methods, breaking ordinary browsing.