Google PCA Manage implementation of cloud architecture Practice Question
A company is using Cloud Armor to protect their external HTTPS load balancer. They want to block traffic from a specific list of IP ranges. They create a security policy with a deny rule. However, the denials seem not to be applied to all backend services. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the misconception that simply having a deny rule in a security policy is sufficient, without understanding that rule priority determines which rule is evaluated first, and an allow rule with lower priority number can override a deny rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security policy is attached to the load balancer's target proxy, but the deny rule priority is lower than an allow rule
Cloud Armor security policies are evaluated against the rules in priority order, with lower numbers having higher priority. If a deny rule has a higher priority number (lower priority) than an allow rule, the allow rule will be evaluated first and permit the traffic, effectively overriding the deny. The most likely cause is that the deny rule's priority is not set lower than any conflicting allow rules, so the allow rule matches first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security policy is not attached to the backend service
Why it's wrong here
If not attached, no rules apply, but the question implies some effect.
- ✓
The security policy is attached to the load balancer's target proxy, but the deny rule priority is lower than an allow rule
Why this is correct
Rules evaluated by priority; higher priority allow rule can override lower priority deny rule.
- ✗
Cloud Armor policies only apply to global load balancers, not regional
Why it's wrong here
Cloud Armor supports both global and regional load balancers.
- ✗
The security policy has an allow rule that overrides the deny rule
Why it's wrong here
Partially correct but not as precise as priority order.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Load balancer
A load balancer is a device or software that distributes incoming network traffic across multiple servers so no single server gets overwhelmed.
Key term
HTTPS
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP that encrypts data between a web browser and a web server using SSL/TLS protocols.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.