Web Security and Zero Trust
Design layered controls while preserving legitimate access, operational visibility, and explicit trust boundaries.
WAF decisions and safe rule operations
Explain WAF scope and limitations
DDoS: network capacity and application exhaustion
Distinguish network and HTTP attack surfaces
Bots, rate limits, and abuse economics
Define abuse before choosing policy
Identity, authorization, and Zero Trust principles
Distinguish authentication from authorization
Access, Gateway, Tunnel, and operating security posture
Distinguish Cloudflare One component responsibilities
Protect a public SaaS application in layers
Design protection for a public SaaS with anonymous browsing, authenticated APIs, administrator access, and a small operations team.
Work through the problem
- Classify assets, users, and abusive behaviors.
- Place DDoS, WAF, bot, rate, identity, and origin controls on a diagram.
- Define safe rollout and false-positive checks.
- Explain residual risks and operational ownership.
Deliverables
- Layered architecture
- Policy rollout plan
- Legitimate-traffic test matrix
Self-review rubric
- Separates network and application attacks
- Preserves application authorization
- Distinguishes Access, Gateway, and Tunnel
- Measures both abuse reduction and legitimate access
Compare with the worked approach
Use network and HTTP DDoS protection for relevant traffic, narrowly scoped WAF and abuse policies for the public application, application authorization for tenant data, and identity-aware access for administration. Protect origin reachability and validate both TLS legs. Roll out policies with representative clients and event review. No one layer replaces secure application design, patching, or incident response.