[CF1] DEX add to learning path

Author: deadlypants1973

src/content/docs/learning-paths/replace-vpn/build-policies/block-page.mdx

@@ -2,7 +2,7 @@
 title: Gateway block page
 pcx_content_type: overview
 sidebar:
-  order: 5
+  order: 6
 ---
 
 import { Render, Tabs, TabItem } from "~/components";

src/content/docs/learning-paths/replace-vpn/build-policies/session-timeouts.mdx

@@ -2,7 +2,7 @@
 title: Session timeouts
 pcx_content_type: overview
 sidebar:
-  order: 4
+  order: 5
 
 ---
 

src/content/docs/learning-paths/replace-vpn/build-policies/shadow-it.mdx

@@ -2,7 +2,7 @@
 title: Shadow IT discovery
 pcx_content_type: overview
 sidebar:
-  order: 6
+  order: 7
 ---
 
 [Shadow IT](https://www.cloudflare.com/learning/access-management/what-is-shadow-it/) refers to the unsanctioned use of software, hardware, or other systems and services within an organization, often without the knowledge of that organization's information technology (IT) department.

src/content/docs/learning-paths/replace-vpn/build-policies/test-your-first-app.mdx

@@ -0,0 +1,79 @@
+---
+title: Test your first application
+pcx_content_type: overview
+sidebar:
+  order: 4
+---
+
+Securing an application is only the first step; you must also verify that your policies are working correctly and that your users have a good experience. Cloudflare's **Digital Experience Monitoring (DEX)** within **Cloudflare Zero Trust** is the ideal tool for this, allowing you to monitor application performance and test your access policies from the end-user perspective.
+
+The page below guides you through setting up a DEX test for your newly secured application.
+
+# Test your first application
+
+After securing your private application with Gateway DNS and Network policies, you should verify the policies are working as expected and monitor the application's performance. Cloudflare's **Digital Experience Monitoring (DEX)** provides the tools to do this.
+
+---
+
+## What is Cloudflare DEX?
+
+**Digital Experience Monitoring (DEX)** gives administrators insights into the end-user connectivity and performance when connecting to resources, leveraging the same global network toolkit Cloudflare uses internally.
+
+DEX allows you to:
+* **Measure performance** for connecting to the Internet and applications.
+* **Track metrics** like response time averages from various locations.
+* **Test connectivity** to an application from a device running the **Cloudflare WARP client**.
+
+---
+
+## Configure a DEX Test on a WARP Device
+
+You can set up synthetic tests—like **HTTP tests** or **Traceroute tests**—to continuously check the performance and availability of your internal application from your WARP-enrolled devices.
+
+For an application like the "Company Wiki" secured in the previous step (e.g., `wiki.internal.com` pointing to `10.128.0.10`), an **HTTP test** is the best way to verify access and measure performance.
+
+### 1. Create a DEX HTTP Test
+
+1.  Open your Cloudflare Zero Trust dashboard.
+2.  Go to **Analytics** > **DEX** > **Tests**.
+3.  Create a new test and configure it for your application. For example:
+    * **Test Type**: HTTP test
+    * **Host**: The domain or IP of your application (e.g., `https://wiki.internal.com`).
+    * **Interval**: How often the test should run (e.g., `15m` for every 15 minutes).
+    * **Name**: `Company Wiki Health Check`.
+    * **Enabled**: Set to **True**.
+
+### 2. Configure WARP Client Testing
+
+The test is conducted by the **WARP client** on devices enrolled in your organization. For the test to work, ensure the WARP client is installed, running, and the device is enrolled.
+
+The DEX test will automatically use the WARP client on enrolled devices to perform the configured checks.
+
+---
+
+## View Performance Metrics
+
+Once the test is running, you can view the results to gain insights into your application's performance as experienced by your users.
+
+1.  In the Cloudflare Zero Trust dashboard, go to **Analytics** > **DEX** > **Tests** > **View test results**.
+2.  Select your new test to see the results.
+
+You can monitor key performance metrics like:
+
+* **Response Time Averages**: The total time it takes to get a response from your application.
+* **DNS Resolution Time**: How long it takes the Gateway DNS policy to resolve the application's domain.
+* **HTTP Status Codes**: Track successful responses (2xx) and quickly detect an increase in client (4xx) or server (5xx) errors, which helps identify issues with your application or policies.
+
+---
+
+## Testing Policy Enforcement
+
+While DEX primarily focuses on experience and performance, the results can also indicate if your Gateway policies are correctly applied.
+
+Since policy enforcement is a fundamental function of Gateway, you should monitor the **Gateway Activity Logs** to see how your policies interact with traffic destined for your application.
+
+1.  In the Cloudflare Zero Trust dashboard, go to **Analytics** > **Logs** > **Gateway activity logs**.
+2.  Filter the logs for your application's domain (e.g., `wiki.internal.com`) or IP address (e.g., `10.128.0.10`).
+3.  Check the **Action** column to verify that your explicit `Allow` DNS and Network policies are being applied, and that the catch-all `Block` policy is *not* being hit for authorized traffic.
+
+**Note**: While setting up, it is not recommended to employ a default-deny model while testing. Instead, build your explicit application policies and **monitor your logs** to determine if your policies are working as expected.