Are there any specific Cloudflare features that must be disabled along with DDoS protection to fully test origin server resilience?

To fully test origin server resilience against direct attacks, you would typically want to disable not only the general DDoS protection but also potentially bypass any WAF (Web Application Firewall) rules, bot management, and ensure your DNS records point directly to your origin IP (effectively removing Cloudflare's proxying) during the test. Development Mode is the closest Cloudflare offers for a broad bypass.