PCNE Practice Question: Designing, Planning, and Prototyping a GCP Network

Exhibit

Refer to the exhibit.

JSON configuration for Cloud Armor security policy:
{
  "name": "prod-security-policy",
  "defaultRuleAction": "allow",
  "rules": [
    {
      "priority": 1000,
      "match": {
        "expr": {
          "expression": "origin.region_code == 'CN'"
        }
      },
      "action": "deny(403)"
    },
    {
      "priority": 2000,
      "match": {
        "expr": {
          "expression": "request.path.startsWith('/admin')"
        }
      },
      "action": "deny(403)"
    },
    {
      "priority": 3000,
      "match": {
        "config": {
          "srcIpRanges": ["192.0.2.0/24"]
        },
        "versionedExpr": "SRC_IPS_V1"
      },
      "action": "deny(403)"
    }
  ]
}

A request comes from IP 192.0.2.5, with origin region code 'US', and path '/admin/dashboard'. What will be the final action?

⚠ Common exam trap

Google Cloud often tests the misconception that rules are evaluated in descending priority order (e.g., 3000 before 2000) or that the default rule overrides explicit deny rules, when in fact the lowest numeric priority wins and evaluation stops at the first match.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deny by rule priority 2000.

The request matches a rule with priority 2000 that denies traffic from IP 192.0.2.5 to path '/admin/dashboard' with origin region 'US'. Since Cloud Armor security policies evaluate rules in ascending priority order, rule 2000 is evaluated before rule 3000 and after rule 1000. Rule 1000 does not match (likely a different condition), so rule 2000 applies and denies the request.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Deny by rule priority 1000.
Why it's wrong here
Rule 1000 requires region code 'CN', which is not the case.
✓
Deny by rule priority 2000.
Why this is correct
The request path starts with '/admin', matching rule 2000.
✗
Deny by rule priority 3000.
Why it's wrong here
Rule 3000 would match as well, but rule 2000 is evaluated first.
✗
Allow (default rule).
Why it's wrong here
The request matches a deny rule before default.

Go deeper

PCNE Practice Question: Designing, Planning, and Prototyping a GCP Network

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question