CF-ZT-ADMIN Practice Test

CF-ZT-ADMIN practice test: what's covered

• Access
• Gateway
• WARP
• Tunnels
• Device Posture
• Posture-Only Mode
• DNS/HTTP/Network Policies
• DLP

Free CF-ZT-ADMIN sample questions

1. A company wants to replace a public VPN for private web applications with identity-aware access. Which response is the BEST fit?

   • A. Publish the apps behind Cloudflare Access with IdP integration, policies, and least-privilege application rules
   • B. Expose the apps publicly and rely on hidden URLs
   • C. Move all users to a flat network VPN with no app policy
   • D. Disable identity checks because Cloudflare provides DNS
   Show answer

   Correct: A. Publish the apps behind Cloudflare Access with IdP integration, policies, and least-privilege application rules is the best answer because Cloudflare Access provides ZTNA-style identity-aware application access. The other choices do not fit the scenario: Expose the apps publicly and rely on hidden URLs addresses the wrong layer or timing, Move all users to a flat network VPN with no app policy skips a required control, and Disable identity checks because Cloudflare provides DNS would create avoidable operational or security risk.

2. A design must verify users and devices before allowing access to sensitive internal apps. Which response is the BEST fit?

   • A. Combine Access identity policies with device posture checks and session controls
   • B. Allow any authenticated email address without device context
   • C. Use DNS filtering alone as application authentication
   • D. Require only a shared password for all contractors
   Show answer

   Correct: A. Combine Access identity policies with device posture checks and session controls is the best answer because Zero Trust decisions should include identity and device context when risk requires it. The other choices do not fit the scenario: Allow any authenticated email address without device context addresses the wrong layer or timing, Use DNS filtering alone as application authentication skips a required control, and Require only a shared password for all contractors would create avoidable operational or security risk.

3. A team is unsure how Gateway and Access differ. Which response is the BEST fit?

   • A. Use Access for inbound private application access and Gateway for outbound user traffic inspection and filtering
   • B. Use Access to scan all outbound DNS traffic
   • C. Use Gateway as the login page for private apps only
   • D. Treat both products as identical firewall names
   Show answer

   Correct: A. Use Access for inbound private application access and Gateway for outbound user traffic inspection and filtering is the best answer because Access and Gateway solve different traffic directions and control points in Cloudflare One. The other choices do not fit the scenario: Use Access to scan all outbound DNS traffic addresses the wrong layer or timing, Use Gateway as the login page for private apps only skips a required control, and Treat both products as identical firewall names would create avoidable operational or security risk.

4. An enterprise is planning a phased SASE rollout. Which TWO choices should the engineer select? (Choose TWO)

   • A. Start with a defined use case such as private app access or secure web gateway
   • B. Measure policy impact with logs and user experience before expanding
   • C. Migrate every control in one weekend with no pilot
   • D. Use one allow-everyone policy until the project ends
   Show answer

   Correct: A and B. Start with a defined use case such as private app access or secure web gateway and Measure policy impact with logs and user experience before expanding are correct because phased rollout reduces risk and creates measurable adoption evidence. The distractors do not satisfy the requirement: Migrate every control in one weekend with no pilot is incomplete for this case, and Use one allow-everyone policy until the project ends solves a different problem or weakens the design.

5. A security architect wants policy decisions to account for country, identity, and device state. Which response is the BEST fit?

   • A. Use Access selectors and rule types to include, require, and exclude the correct conditions
   • B. Create one DNS record per country and call it policy
   • C. Use only IP allowlists because identity is unavailable
   • D. Bypass Access for high-risk countries to improve performance
   Show answer

   Correct: A. Use Access selectors and rule types to include, require, and exclude the correct conditions is the best answer because Access policies evaluate selectors and rule logic for contextual authorization. The other choices do not fit the scenario: Create one DNS record per country and call it policy addresses the wrong layer or timing, Use only IP allowlists because identity is unavailable skips a required control, and Bypass Access for high-risk countries to improve performance would create avoidable operational or security risk.

Last updated: 2026-10-19

CF-ZT-ADMIN practice test FAQ