100% behind cloudflare; Ports are closed; is a DDOS possible?

Hi folks,

If a server is 100% behind cloudflare and the ports are closed otherwise through the software firewall, and the IP address is widely known, is a DDOS attack still possible?

What can be done to mitigate any attacks in this scenario?

Thanks for all your insights!