How Cloudflare Interviews in 2026: Process, Questions & What They Score

• Design a data structure for a least recently used (LRU) cache.Tests hash map plus doubly linked list design and, in some loops, thread safety under concurrency.
• Implement a cache with time-to-live expiry.Tests expiry bookkeeping and whether eviction is lazy on read or actively swept.
• Build a token-bucket rate limiter.Tests choosing and defending a rate-limiting algorithm such as token bucket or sliding window.
• Implement a multi-level rate limiter.Tests turning a layered rate-limit requirement into clean, composable abstractions.
• Determine whether an IP address falls within a given CIDR block.Tests bitwise IP address and subnet mask arithmetic.
• Parse a stream of logs and aggregate error counts by status code.Tests streaming parse and aggregation without buffering the entire log in memory.
• Implement a small protocol or format handler, such as a tiny HTTP parser, a TLV decoder, or a WebSocket frame reader.Tests binary or text protocol parsing such as framing, length prefixes, or state machines.
• Implement a connection or resource pool with fairness and timeout constraints.Tests concurrency control: pool sizing, fairness under contention, and timeout handling.
• Implement streaming aggregation: top-K, sketches, or sliding window counts.Tests approximate streaming techniques such as count-min sketch or sliding window counters.
• Design a circular queue.Tests fixed-size buffer indexing with wraparound using modular arithmetic.
• Solve 3Sum and 4Sum.Tests the two-pointer technique on sorted arrays to avoid brute-force cubic or quartic time.
• Find the longest palindromic substring in a given string.Tests the expand-around-center or dynamic programming technique for substrings.
• Implement a function to reverse a linked list.Tests in-place pointer manipulation on a singly linked list.
• Explain how a hash table works and how to handle collisions.Tests hashing and collision handling via chaining or open addressing.
• Explain the time and space complexity of quicksort. How can it be optimized?Tests sorting complexity analysis and pivot-selection optimizations like median-of-three.
• Check whether a binary tree is balanced.Tests recursive height calculation with early exit on imbalance.
• Perform an in-order traversal of a binary tree.Tests recursive or explicit-stack tree traversal ordering.
• Find the missing number in an array containing 1 to n.Tests the sum-formula or XOR technique for finding a missing value in linear time.
• Design browser history navigation.Tests object-oriented design of a back and forward navigation stack.

Reported problems, listed so you know what to expect. Practice them in your own editor or on the platform you prefer; SupaCV's practice mode coaches how you talk through them.

• Design a distributed rate limiter that enforces a per-API-key limit across hundreds of edge locations.Tests distributed counting and consistency tradeoffs for a limiter shared across many edge nodes.
• Design the cache purge and invalidation system for a CDN with billions of entries.Tests invalidation strategy at scale: versioning, tombstones, or propagation delay tradeoffs.
• Design a globally distributed key-value store with low read latency, similar to Cloudflare Workers KV.Tests replication strategy and read-latency tradeoffs for a globally distributed store.
• Design a global content delivery network.Tests end-to-end CDN architecture: edge caching, origin shielding, and request routing.
• Design a system to handle millions of DNS queries per second.Tests high-throughput DNS resolution architecture and caching layers.
• Design a DDoS mitigation system.Tests traffic-filtering architecture for absorbing and scrubbing volumetric attacks.
• Design a log collection and aggregation system across global edge data centers.Tests log ingestion pipeline design across globally distributed data centers.
• Design a system for real-time analytics of website traffic.Tests streaming aggregation architecture for near-real-time traffic metrics.
• Design a URL shortener, covering requirements clarification, high-level architecture, detailed design, and scaling.Tests classic system design fundamentals: encoding scheme, storage, and read scaling.

Reported problems, listed so you know what to expect. Practice them in your own editor or on the platform you prefer; SupaCV's practice mode coaches how you talk through them.

• Walk me through what happens, step by step, when you type a URL into a browser and press enter.Tests depth across DNS, TCP, TLS, HTTP, and rendering in one continuous explanation.
• Explain the difference between TCP and UDP. When would you use one over the other?Tests understanding of reliability and ordering tradeoffs between transport protocols.
• Explain SSL/TLS and how it ensures secure communication, then walk through the handshake.Tests TLS 1.3 handshake mechanics and how it cuts round trips versus TLS 1.2.
• Compare QUIC and TCP. What are the tradeoffs?Tests understanding of head-of-line blocking and connection migration tradeoffs.
• How does DNS resolution work?Tests the recursive resolver to authoritative server lookup chain.
• What is a DDoS attack, and how can it be mitigated?Tests general knowledge of volumetric, protocol, and application-layer attack types.
• Describe the OSI model and its layers.Tests recall and correct ordering of the seven OSI layers.
• Explain the purpose and functioning of HTTPS.Tests understanding of how TLS wraps HTTP to provide confidentiality and integrity.
• What are the main differences between symmetric and asymmetric encryption?Tests the key-management and performance tradeoffs between the two encryption types.
• How does a firewall work, and what are its limitations?Tests packet filtering concepts and the limits of stateless versus stateful rules.

Reported problems, listed so you know what to expect. Practice them in your own editor or on the platform you prefer; SupaCV's practice mode coaches how you talk through them.

• What are the differences between Full, Flexible and Strict SSL/TLS modes?Tests knowledge of Cloudflare's SSL/TLS modes and where each one terminates encryption.
• Explain how Cloudflare's DDoS protection works and how you would configure it.Tests familiarity with Cloudflare's specific DDoS mitigation controls and settings.
• Describe Zero Trust security and how Cloudflare implements it.Tests understanding of identity-based access replacing perimeter-based network trust.
• What steps would you take to implement rate limiting for a specific endpoint?Tests configuring Cloudflare's rate-limiting rules for a specific endpoint.
• Describe how to create and apply a firewall rule to block traffic from a specific country.Tests Cloudflare firewall rule syntax for geography-based traffic blocking.
• Write a script to add a new DNS record using Cloudflare's API.Tests scripting against Cloudflare's API to manage DNS records programmatically.
• Give a detailed approach to troubleshooting intermittent connectivity issues.Tests systematic network troubleshooting method for intermittent connectivity failures.

Reported problems, listed so you know what to expect. Practice them in your own editor or on the platform you prefer; SupaCV's practice mode coaches how you talk through them.

• Tell me about a mistake you made that affected production and what you learned.
• Describe a time you disagreed with a technical decision.
• Give an example of a time you had to explain a complex technical concept to a non-technical audience.
• Describe a situation where you had to make a decision with incomplete information.
• Tell me about a time when you had to deal with a difficult team member.
• Tell me about a time when you had to learn a new technology quickly.
• How do you stay updated with the latest technologies and industry trends?
• Describe a project you are particularly proud of and your role in it.
• Can you share an example of how you have contributed to improving a process or system?
• Tell me about a time you debugged a performance problem.
• Why would you like to join Cloudflare?

Cloudflare's process has 15 stages, in order: Application and resume screen, Recruiter screen (Cloudflare calls this stage "Initial Conversations"), Hiring manager screen, Technical screen (live coding, or a HackerRank-style online assessment for some pipelines), Take-home assignment (some teams only), Virtual onsite loop (Cloudflare calls this stage "Team Panel Interviews"), Onsite round: applied coding or code pair, Onsite round: debugging in unfamiliar code, Onsite round: AI-assisted coding (some teams), Onsite round: systems and networking deep dive, Onsite round: system design, Onsite round: cross-functional / product manager interaction, Orange Cloud behavioral interview, Executive call with senior leadership, Decision and offer.

Cloudflare evaluates candidates against Cloudflare Capabilities: Be curious to learn and grow, Communicate clearly and transparently, Do the right thing, Embrace diversity, Get your work across the finish line, Lead with empathy.

Cloudflare's question bank spans 5 categories: Coding and applied implementation; System design at edge scale; Networking, protocols and security; Cloudflare product and platform; Orange Cloud behavioral.

This playbook is medium confidence, compiled from 11 public sources, and last verified September 6, 2026. It describes one well-documented shape of Cloudflare's interviews, not a guarantee of what any individual loop will look like.