Flashcards

Use the interactive controls with JavaScript. Study progress stays in your browser. Read the study guide and backup instructions.

Customer Engineer

A technical partner who helps customers evaluate, implement, and realize outcomes from technology; scope varies by team.

Solutions Engineer

A role commonly focused on technical discovery and evaluation, often before purchase.

Forward-deployed engineering

Engineering embedded close to customer problems, often including substantial custom implementation.

Technical win

Evidence that the solution meets agreed technical evaluation criteria; it is not a purchase commitment.

Onboarding

The work that establishes a usable and operable deployment.

Adoption

Continued use of intended capabilities in a way that supports the customer outcome.

Symptom

An observed undesirable behavior, such as timeout or high latency.

Hypothesis

A testable explanation that predicts observable evidence.

Success criterion

A measurable condition agreed in advance for judging an evaluation.

Proof of concept

A bounded experiment that tests whether a proposed approach satisfies customer-specific criteria.

Baseline

A measured reference condition used for comparison.

Acceptance threshold

The agreed boundary that determines whether a test result is sufficient.

Trusted advisor

A practitioner whose guidance is credible because it is accurate, candid, and aligned with the customer outcome.

Account Executive

The account role commonly responsible for commercial relationship and sales coordination.

Expansion

Additional customer adoption or commercial scope tied to further needs and value.

Recursive resolver

A DNS service that resolves names on behalf of clients, usually using caching and delegation.

Authoritative DNS

A server role that supplies authoritative records for a zone.

DNS TTL

The normal freshness lifetime of a DNS answer. Serve-stale resolvers may reuse expired data when refresh fails.

TCP

A transport protocol providing a reliable ordered byte stream with congestion control.

UDP

A datagram transport without built-in delivery or ordering guarantees.

QUIC

A secure multiplexed transport built over UDP, used by HTTP/3.

TLS

The protocol family used to authenticate peers and protect transport confidentiality and integrity.

SNI

A TLS extension carrying the requested server name to help select the appropriate configuration.

Certificate chain

A sequence linking a server certificate through issuers to a trusted authority.

Reverse proxy

An intermediary acting on behalf of upstream servers.

Forward proxy

An intermediary acting on behalf of clients accessing other services.

Cache key

The request-derived identifier used to select a cached representation.

Anycast

Advertising the same network prefix from multiple locations so routing selects a reachable instance.

TTFB

Time to first response byte as observed and defined by a particular measurement tool.

Tail latency

The slow end of a latency distribution, often expressed using high percentiles.

CIDR

Classless Inter-Domain Routing notation that describes an address prefix and its length.

Subnet

A logically defined address range within a larger network.

Longest-prefix match

Selecting the most specific matching destination prefix in a routing table.

BGP

The interdomain routing protocol used to exchange prefix reachability and routing attributes.

Autonomous system

A network or group of networks operated under a common routing policy and identified by an ASN.

Control plane

The mechanisms that learn and select forwarding information.

Load balancing

Distributing requests or connections among service endpoints according to selection and health policies.

NAT

Translation of network addresses and sometimes ports between network contexts.

Segmentation

Enforced separation of network communication according to explicit policy.

VPN

A logical private connection over another network, commonly using encryption to protect traffic.

MPLS

A forwarding method that uses labels through a network; it does not inherently provide end-to-end encryption.

SD-WAN

Software-defined policy and management for wide-area connectivity across available transports.

SASE

An architecture combining wide-area networking and cloud-delivered security capabilities.

MTU

The maximum packet size a link or interface can carry without fragmentation at the relevant layer.

Asymmetric routing

Forward and return traffic taking different network paths.

Flow log

Metadata describing observed network traffic, often including endpoints, ports, direction, and policy outcome.

WAF

A control that evaluates HTTP requests against application security rules.

False positive

A legitimate activity incorrectly classified or handled as undesirable.

Managed rule

A vendor-maintained detection rule or rule set intended to address known attack patterns.

DDoS

A distributed attempt to deny service by exhausting or disrupting resources.

Layer 7 attack

An attack using application-layer behavior, such as expensive HTTP requests.

Origin bypass

Traffic reaching the origin directly and avoiding the intended edge controls.

Credential stuffing

Automated attempts to use previously compromised credentials against another service.

Rate-limit key

The identity or request characteristics used to group activity for counting.

Bot signal

An indicator used to assess whether traffic is automated or suspicious; it is not definitive intent.

Authentication

Establishing the identity of a user, device, or service.

Authorization

Deciding whether an identity may perform a specific action on a resource.

Least privilege

Granting only the access necessary for the intended task.

Device posture

Signals about a device state used as input to access policy.

Cloudflare Access

Cloudflare application access controls that evaluate policy for users and services.

Cloudflare Gateway

Cloudflare secure web gateway capabilities for applying policies to outbound DNS, network, and HTTP traffic.

Cloudflare Tunnel

A connector-based service that establishes outbound connections from resources to Cloudflare.

Security posture

The current condition of an organization’s security controls, coverage, configuration, and operational readiness.

Proxy status

Whether an eligible DNS record routes application traffic through Cloudflare's proxy or only publishes DNS answers.

Cache eligibility

The policy decision determining whether a response may be stored and reused.

At-least-once delivery

A delivery contract allowing a message to be delivered more than once, requiring duplicate-safe effects.

Dead-letter queue

A destination for work that exhausted normal processing attempts and needs inspection or controlled replay.

Asynchronous acceptance

Acknowledging that work was accepted without asserting its final business operation has completed.

System of record

The authoritative source used to resolve disagreement about a particular business datum.

Coordination boundary

The unit of state and work that must agree on ordering or concurrency.

Read-after-write expectation

The application's requirement for what a read should observe after an acknowledged write.

Secure web gateway

A service that applies security policy to users' or networks' Internet-bound traffic.

ZTNA

Zero Trust Network Access: granting application access using explicit context and policy instead of broad network trust.

On-ramp

A connection method that brings network traffic onto a provider's network or service.

Inference plane

The portion of an AI system that executes a model on input and returns output.

Retrieval grounding

Supplying relevant source material to inform an answer without guaranteeing its correctness.

Quality telemetry

Measurements of answer usefulness or correctness, distinct from infrastructure success and latency.

Dependency graph

A representation of the components and calls required to complete an operation.

Deadline budget

The maximum elapsed time allocated across a request and its downstream work.

Domain boundary

A division of business responsibility that clarifies ownership of rules and data.

Idempotency key

A stable identifier used to recognize repeated attempts at the same intended operation.

Backpressure

A mechanism that limits incoming work when downstream processing cannot keep up.

Retry amplification

The multiplication of attempts when several layers independently retry the same failing operation.

High cardinality

A large number of distinct values in a telemetry dimension, potentially increasing storage and query costs.

Trace span

A timed operation within a distributed trace, with context linking it to related work.

Minimal reproducer

The smallest practical input and environment that reliably demonstrates a failure.

Fault isolation

Narrowing a failure to a component or boundary using discriminating evidence.

Mitigation

An action that reduces current impact even before the underlying defect is fully understood.

Incident timeline

A timestamped record of observations, decisions, actions, and resulting system behavior.

SLO

A target for a defined service-level indicator over an explicit measurement window.

RTO

Recovery Time Objective: the targeted maximum time to restore a service after disruption.

RPO

Recovery Point Objective: the targeted maximum amount of recent data that may be lost, expressed as time.

Evaluation set

A curated collection of inputs and expected assessment criteria used to compare system behavior.

Structured output validation

Checking generated data against a schema and separate business rules before use.

Time to first token

Elapsed time until a streaming model begins returning output, distinct from total completion time.

Embedding space

The numerical representation produced by a particular embedding model in which similarity is measured.

Chunking

Dividing source material into retrieval units while preserving enough context for useful interpretation.

Retrieval recall

The proportion of relevant evidence successfully retrieved for a query or evaluation set.

Tool authorization

Application-enforced permission to execute a specific tool action under the current identity and scope.

Bounded autonomy

Delegating decisions within explicit limits on authority, steps, time, and resource consumption.

Workflow reconciliation

Determining actual external state after partial or ambiguous execution and bringing records back into agreement.

Semantic cache risk

The possibility that reusing an apparently similar answer crosses context, freshness, or authorization boundaries.

Fallback policy

Rules governing when an alternate provider or model is used and which correctness and privacy constraints still apply.

Consumption budget

A bound on model usage or cost for a request, user, tenant, or time window.

Held-out evaluation

Assessment using cases not used to tune the current system, helping detect overfitting.

Abstention quality

How appropriately a system declines to answer when evidence or authority is insufficient.

Evaluation regression

A deterioration in a defined behavior or category after a system change.

Discovery agenda

A shared outline of the problem, desired decision, participants, and available time.

Diagnostic question

A question designed to distinguish plausible explanations using evidence.

Working comparison

A similar case that succeeds and can help isolate the failing boundary.

Technical champion

A customer advocate with technical credibility who helps evaluate and communicate the proposed change internally.

Decision owner

The person or group authorized to approve a specific decision.

Hard constraint

A requirement that the current decision must satisfy unless an authorized owner changes it.

PoC charter

The agreed scope, hypothesis, tests, owners, criteria, and decision process for an evaluation.

Exit criterion

A condition that determines whether a phase or evaluation can conclude.

Scope creep

Uncontrolled expansion of work beyond the agreed evaluation or project boundary.

Technical objection

A concern about feasibility, risk, operation, or fit that must be understood before a decision.

Calibrated confidence

Language that distinguishes verified facts from degrees of uncertainty.

Trust boundary

A point where data or requests cross between different security assumptions or control domains.

Executive readout

A concise explanation of impact, evidence, options, tradeoffs, and the decision required.

Decision record

A durable note describing the chosen option, rationale, assumptions, and consequences.

GTM

Go-to-market: the coordinated approach to reaching customers, delivering value, and sustaining commercial relationships.

Mutual action plan

A shared plan of customer and vendor commitments, owners, evidence, and decision dates.

Economic buyer

The stakeholder with authority over the business expenditure or investment decision.

Mandatory requirement

A condition whose failure prevents acceptance, regardless of performance on preferred criteria.

Time-to-value

Elapsed time from an agreed starting point to the first verified customer outcome.

Cross-sell

Adding a different product or capability to address an additional customer need.

QBR

Quarterly business review: a structured review of outcomes, evidence, risks, and agreed priorities.

TCO

Total cost of ownership across purchase, use, operation, migration, and relevant transition costs.

ROI

Return on investment: net benefit divided by investment for a defined period and accounting convention.

Sensitivity analysis

Testing how a conclusion changes when uncertain assumptions vary.

OTE

On-target earnings: base pay plus target variable compensation under stated performance assumptions.

Quota attainment

Measured performance relative to a defined quota under the compensation plan's rules.

Accelerator

A compensation-plan mechanism that increases payout rate after a specified performance threshold.

Career through-line

The coherent pattern of capabilities and motivations connecting different roles and projects.

Claim ledger

A record linking interview statements to evidence, personal contribution, and remaining uncertainty.

Evidence theme

A small group of related examples that demonstrates a capability without recounting an entire career.

PCATO

A course-created mnemonic: Problem, Constraints, Actions, Tradeoffs, Outcome. It is a practice structure, not an official interview rubric.

Attribution boundary

The distinction between your own contribution and work performed by teammates or external systems.

Outcome to verify

An explicit marker for a result or metric that must be confirmed before being presented as fact.

Assumption register

A visible list of unverified premises that materially affect an architecture or decision.

Discriminating test

A test whose possible results help distinguish between competing hypotheses.

Whiteboard contract

The shared understanding of what diagram symbols, boundaries, and assumptions mean during a discussion.

Reflective summary

Restating the customer's problem and constraints to confirm shared understanding before proposing action.

Constructive dissent

Challenging a proposal with evidence and alternatives while respecting people and decision ownership.

Closed-loop handoff

A transfer of context and responsibility that includes acknowledgment, ownership, and follow-up expectations.

Role calibration

Clarifying the actual level, scope, team expectations, and evaluation criteria for a position.

Interview debrief

A structured private record of questions, evidence, feedback, and unresolved points after an interview.

Promise tracking

Recording commitments and confirming that the requested artifact or action is delivered accurately.

DNS — selection tradeoff

Use it when migrating a public zone, managing records through automation, or adopting proxy services for eligible web hostnames. Do not expect a DNS-only record to route HTTP through the WAF or CDN. DNS changes also cannot repair an unhealthy application. Delegation, DNSSEC, stale resolver caches, and mail records require careful migration. Inventory the zone and retain a rollback plan before changing nameservers.

CDN and Cache — selection tradeoff

Use it for public assets and deliberately cacheable pages or API responses, with explicit freshness and invalidation requirements. Do not share personalized or sensitive responses without correct cache isolation. A cache cannot make every dynamic database operation faster. Freshness, hit ratio, key cardinality, cookies, and purge behavior interact. A higher hit ratio is harmful if users receive another user’s response.

Web Application Firewall — selection tradeoff

Use managed rules for common attack patterns and carefully scoped custom rules for application-specific risk and observed abuse. Do not treat it as a replacement for secure code, authorization checks, patching, or protecting an origin that attackers can reach directly. Aggressive rules may block legitimate users. Plan availability and capabilities differ; tune narrow exceptions using evidence instead of disabling protection globally.

DDoS protection — selection tradeoff

Use the appropriate protection path for HTTP applications or network traffic, and confirm that the customer’s actual traffic traverses that path. Do not equate an HTTP service configuration with protection of every public IP or protocol. Legitimate overload still needs capacity and application controls. Tuning must preserve legitimate traffic. Confirm architecture, supported protocols, escalation process, monitoring, and commercial entitlement rather than assuming identical coverage everywhere.

Workers — selection tradeoff

Use it for compatible application workloads, edge request handling, and new full-stack projects that fit the runtime and execution model. Do not assume an arbitrary existing server process, native binary, or Node.js package works unchanged. Validate required APIs and runtime limits first. Runtime compatibility, CPU consumption, data location, and remote service latency matter. Moving compute nearer users does not automatically move a regional database.

Pages — selection tradeoff

Use this knowledge to support existing Pages customers, evaluate their deployment workflow, and understand preview and rollback needs. For a new application, start by evaluating Workers: current Pages documentation explicitly recommends Workers as Cloudflare’s primary application platform. Migration is a workflow and compatibility exercise. Inventory routes, redirects, bindings, build settings, and deployment behavior before promising a seamless move.

R2 — selection tradeoff

Use it when the unit of storage is an object addressed by a key, especially alongside Workers applications and supported S3-compatible integrations. Do not use object storage as a relational database, a block device, or an implicit replacement for transactional updates across multiple business records. S3 compatibility does not imply every S3 feature is identical. Design authorization, lifecycle, object naming, caching, and recovery around documented capabilities.

D1 — selection tradeoff

Use it for structured application data where tables, indexes, joins, and SQL queries fit the workload and documented scaling model. Do not assume it is a drop-in PostgreSQL replacement or an unrestricted distributed write database. Test schema and transaction requirements. Indexes, query shapes, database size, and write pressure influence suitability. Read replication does not eliminate the need to reason about write location and consistency.

Workers KV — selection tradeoff

Use it when many requests read the same keys and the application can tolerate propagation delay after updates. Do not use it for authoritative balances, inventory reservations, or immediate global revocation when stale reads would violate correctness or security. Cached old values and cached negative lookups affect freshness. More caching can improve reads while increasing the duration of stale observations.

Durable Objects — selection tradeoff

Use it for collaboration rooms, per-entity coordination, WebSocket sessions, or other workloads with a clear partitioning key. Do not route every customer through one object or assume transactions span arbitrary objects. A hot coordination key can become a bottleneck. Partition design governs scale and cross-object complexity. Users far from an object still experience network latency; global addressability is not zero-distance state.

Queues — selection tradeoff

Use it for background processing, ingestion, notifications, and workloads where temporary downstream failure should not block the interactive request. Do not assume exactly-once business effects or use a queue to conceal an unbounded backlog with no capacity plan. Retries improve delivery resilience but can amplify load. Use idempotency, bounded retries, dead-letter handling, and age-of-oldest-message monitoring.

Hyperdrive — selection tradeoff

Use it when retaining an existing compatible database while moving application request handling to Workers. Do not describe it as migrating the database or making every write local worldwide. It cannot fix slow SQL or inadequate database capacity. Query freshness, supported database features, connection limits, and network reachability remain architectural concerns. Benchmark representative reads and writes separately.

Workers AI — selection tradeoff

Use it when an available model meets the application’s quality, latency, task, and governance requirements after evaluation. Do not assume every model, arbitrary model weight, or training workload is automatically supported. A convenient API does not establish answer quality. Model behavior, throughput, latency, limits, and data handling vary. Evaluate quality and failure behavior before replacing an existing model.

AI Gateway — selection tradeoff

Use it when teams need consistent request telemetry and operational policies across AI application traffic or multiple providers. Do not confuse a gateway with a model, a full application evaluator, or an automatic guarantee that fallback answers are equally correct. Logging can contain sensitive prompts. Cache keys must preserve tenant and context boundaries; retries and fallbacks need bounded latency and spending.

Vectorize — selection tradeoff

Use it for retrieval-augmented generation, recommendations, and similarity search when embeddings represent the relevant meaning of your data. Do not use nearest-neighbor similarity as an authorization check or assume it is a replacement for a transactional source of truth. Embedding dimensions, model changes, metadata filtering, ingestion freshness, and retrieval quality matter. Re-embedding can be a substantial migration task.

Cloudflare One — selection tradeoff

Use it when a customer needs coordinated application access, Internet traffic filtering, device context, and network connectivity across locations. Do not treat the platform name as one switch or presume that purchasing it instantly replaces every legacy security and networking capability. Identity integration, endpoint rollout, traffic steering, legacy applications, exceptions, and continuity planning determine migration complexity more than a product diagram.

Access — selection tradeoff

Use it for employee or contractor application access, service authentication, and policies incorporating identity and available device posture signals. Do not assume successful authentication grants every application privilege. Business authorization inside the application remains necessary, and origin bypass must be addressed. IdP availability, session behavior, policy ordering, device enrollment, and emergency access need deliberate testing. Broad bypass policies can undermine the intended control.

Gateway — selection tradeoff

Use DNS, network, and HTTP controls according to the visibility and enforcement required, with traffic steered through supported connectivity methods. Do not assume DNS filtering inspects URLs or encrypted request bodies. Do not confuse outbound user protection with a WAF protecting a public server. Certificate trust, privacy, pinned applications, exceptions, and client rollout affect deployment. Test policies with a pilot cohort before organization-wide enforcement.

Tunnel — selection tradeoff

Use it to publish supported applications or connect private resources, choosing the matching client and policy architecture for the intended protocol. Do not treat connectivity as authorization. A published application still needs appropriate Access or application controls, and the connector must remain healthy. Connector placement, replicas, origin reachability, DNS, and network restrictions determine reliability. A healthy connector does not prove the downstream application is healthy.

Magic Transit — selection tradeoff

Use it when protecting public network traffic and IP space requires a network-level architecture, including on-premises, hosted, or hybrid environments. Do not position it as a substitute for application authentication, a full WAN design, or automatically enabled protection for every customer address. Onboarding requires address, routing, tunnel, return-path, MTU, and operational planning. Eligibility and connectivity choices must be confirmed for the specific network.

Cloudflare WAN (formerly Magic WAN) — selection tradeoff

Use it when site-to-site connectivity and network-layer policy are requirements, with identity-aware Cloudflare One capabilities added where needed. Do not equate WAN connectivity with user-level authorization or claim that Internet underlay circuits become unnecessary. Underlay quality, overlapping addresses, routing, MTU, failover, and segmentation remain design responsibilities. Current documentation describes the service as enterprise-only.

Analytics and observability — selection tradeoff

Use dashboards to identify patterns, query APIs for repeatable analysis, and correlate Cloudflare evidence with origin and application telemetry. Do not assume a dashboard contains every request or proves root cause. Availability, retention, aggregation, and sampling depend on the dataset. Define time windows, denominators, sampling, and identifiers before comparing graphs. Average latency can conceal an important regional or tail-latency failure.

Load Balancing — selection tradeoff

Use it when multiple viable origins exist and the application’s data and session design can support the intended traffic distribution. Do not expect it to create capacity, replicate a database, or make two unhealthy origins healthy. Failover needs a working destination. Monitor thresholds, session affinity, DNS behavior, data consistency, and fallback capacity affect recovery. An HTTP success code alone may hide a broken business workflow.

Logs and Logpush — selection tradeoff

Use it for incident correlation, security investigation, and retention workflows when the appropriate dataset and entitlement meet the requirement. Do not assume all products expose identical fields or that every account receives the same logging capabilities. Export alone is not an alerting program. Field selection, sensitive information, delivery health, volume, destination permissions, and retention cost must be designed. Monitor the pipeline as well as the application.