CF-APPSEC Practice Test

CF-APPSEC practice test: what's covered

• WAF
• Managed Rules
• Rate Limiting
• Bot Management
• API Shield
• DDoS
• Logs

Free CF-APPSEC sample questions

1. A security engineer needs to reduce application attack risk with vendor-maintained detections during a controlled production rollout. Which response is the BEST fit?

   • A. enable appropriate managed WAF rules and stage changes with logging and exceptions — with change evidence recorded
   • B. write one broad allow rule before all managed rules — with change evidence recorded
   • C. block only by country — with change evidence recorded
   • D. turn off rule updates permanently — with change evidence recorded
   Show answer

   Correct: A. enable appropriate managed WAF rules and stage changes with logging and exceptions — with change evidence recorded is the best answer because managed rules provide maintained coverage while staged tuning controls false positives. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes rule version, action, matched requests, and exception scope.

2. An administrator must reduce application attack risk with vendor-maintained detections while investigating an urgent support case. Which action should be taken first?

   • A. enable appropriate managed WAF rules and stage changes with logging and exceptions — after confirming scope and ownership
   • B. write one broad allow rule before all managed rules — after confirming scope and ownership
   • C. block only by country — after confirming scope and ownership
   • D. turn off rule updates permanently — after confirming scope and ownership
   Show answer

   Correct: A. enable appropriate managed WAF rules and stage changes with logging and exceptions — after confirming scope and ownership is the best answer because managed rules provide maintained coverage while staged tuning controls false positives. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes rule version, action, matched requests, and exception scope.

3. A company plans to reduce application attack risk with vendor-maintained detections during an audit-readiness review. Which design best meets the requirement?

   • A. enable appropriate managed WAF rules and stage changes with logging and exceptions — using the vendor-supported workflow
   • B. write one broad allow rule before all managed rules — using the vendor-supported workflow
   • C. block only by country — using the vendor-supported workflow
   • D. turn off rule updates permanently — using the vendor-supported workflow
   Show answer

   Correct: A. enable appropriate managed WAF rules and stage changes with logging and exceptions — using the vendor-supported workflow is the best answer because managed rules provide maintained coverage while staged tuning controls false positives. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes rule version, action, matched requests, and exception scope.

4. During troubleshooting, the team must reduce application attack risk with vendor-maintained detections after a regional service change. Which next step is most defensible?

   • A. enable appropriate managed WAF rules and stage changes with logging and exceptions — with least privilege preserved
   • B. write one broad allow rule before all managed rules — with least privilege preserved
   • C. block only by country — with least privilege preserved
   • D. turn off rule updates permanently — with least privilege preserved
   Show answer

   Correct: A. enable appropriate managed WAF rules and stage changes with logging and exceptions — with least privilege preserved is the best answer because managed rules provide maintained coverage while staged tuning controls false positives. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes rule version, action, matched requests, and exception scope.

5. An administrator needs to reduce application attack risk with vendor-maintained detections before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. enable appropriate managed WAF rules and stage changes with logging and exceptions — with monitoring and rollback defined
   • B. verify the result using rule version, action, matched requests, and exception scope — with monitoring and rollback defined
   • C. write one broad allow rule before all managed rules — with monitoring and rollback defined
   • D. block only by country — with monitoring and rollback defined
   • E. turn off rule updates permanently — with monitoring and rollback defined
   Show answer

   Correct: A and B. enable appropriate managed WAF rules and stage changes with logging and exceptions — with monitoring and rollback defined and verify the result using rule version, action, matched requests, and exception scope — with monitoring and rollback defined are correct because managed rules provide maintained coverage while staged tuning controls false positives. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this Cloudflare Application Security scenario.

Last updated: 2026-10-19

CF-APPSEC practice test FAQ