CNS Practice Test

CNS practice test: what's covered

• Cloudflare Network Specialist
• CDN
• WAF
• Zero Trust
• Workers

Free CNS sample questions

1. A site behind Cloudflare serves dynamic HTML at the root path but immutable JS/CSS under /static/. Without changing origin headers, you want HTML to bypass the edge cache while /static/ assets cache for 30 days. What is the cleanest configuration?

   • A. Add a Page Rule "Cache Everything" at the zone apex and another rule for /static/
   • B. Create two Cache Rules — Rule 1 matches Hostname eq site.com AND Path eq "/*" → "Bypass cache"; Rule 2 matches Path starts_with "/static/" → "Eligible for cache" with Edge TTL = 30d, ordered above Rule 1
   • C. Set Browser Cache TTL to 30 days under Caching > Configuration
   • D. Disable the cache globally in Caching > Configuration so origin headers always win
   Show answer

   Correct: B. Cache Rules are the modern (post-2023) replacement for Page Rules — evaluated in order with first-match-wins. Place the more specific /static/ rule ABOVE the broader bypass rule. Page Rules are deprecated. Browser Cache TTL controls only the downstream Cache-Control header, not edge behaviour. Disabling cache globally would kill performance.

2. A user reports cf-cache-status: DYNAMIC on a URL you expect to be cached. Which is the MOST likely cause?

   • A. The origin returned a 5xx and Cloudflare refuses to cache errors
   • B. The URL contains a query string and no rule explicitly tells Cloudflare to cache it, OR the response carries a Set-Cookie / Cache-Control: private header
   • C. TLS handshake failed on the edge
   • D. The zone is on the Free plan and DYNAMIC is the only status available
   Show answer

   Correct: B. DYNAMIC means the asset was deemed uncacheable. Default behaviour: query strings + Set-Cookie + Cache-Control: private / no-store all bypass cache. To cache anyway, use a Cache Rule that explicitly sets "Eligible for cache" + an Edge TTL override.

3. Which TWO statements about Tiered Caching are TRUE? (Choose 2)

   • A. Tiered Caching adds an Upper Tier data center that fans in misses from edge POPs, reducing origin egress and improving hit ratio
   • B. It is incompatible with HTTPS — origin must serve plain HTTP
   • C. Smart Tiered Cache Topology automatically picks the best upper tier per zone, no config needed
   • D. It works only on the Enterprise plan
   • E. It increases origin egress because each POP fetches independently
   Show answer

   Correct: A and C. Tiered Caching collapses cross-POP misses into a single upper-tier request to origin. Smart Tiered Cache (auto) is available to all paid plans. HTTPS is fully supported. The whole point is to REDUCE origin egress.

4. You need to purge a single asset https://site.com/app.js?v=123 from cache globally. Which API call is correct?

   • A. POST /zones/{zone_id}/purge_cache with body {"files":["https://site.com/app.js?v=123"]}
   • B. DELETE /accounts/{acct_id}/cache
   • C. POST /zones/{zone_id}/purge_cache with body {"prefixes":["/app.js"]}
   • D. GET /zones/{zone_id}/cache/purge?path=/app.js
   Show answer

   Correct: A. Single-file purge uses the "files" array with full URLs. "prefixes" is Enterprise-only and matches path prefixes. The correct verb is POST. A token with "Cache Purge: Edit" permission on the zone is required.

5. A customer enables Argo Smart Routing. They see latency improvements on dynamic POST requests but no change on cache HITs. Why?

   • A. Argo Smart Routing is broken on POST
   • B. Argo Smart Routing optimises the Cloudflare → origin path, so cache HITs (served from the edge) never traverse it
   • C. Cache HITs are also rerouted, but the metric only counts ms-level changes
   • D. Argo Smart Routing requires Workers to be enabled
   Show answer

   Correct: B. Argo accelerates the long-haul Cloudflare-to-origin leg using Cloudflare's real-time network telemetry. Cache HITs are served directly from the user's nearest POP, so Argo is irrelevant for them. The win shows up on MISS / DYNAMIC traffic.

Last updated: 2026-10-19

CNS practice test FAQ