PCNE Configuring Network Services Practice Question
Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?
⚠ Common exam trap
Google Cloud often tests the misconception that false positives from WAF rules are best handled by adding allow rules or rate limiting, rather than tuning the rule's sensitivity or exclusions, which is the proper Cloud Armor mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.
The preconfigured WAF rule for SQL injection (sqli-stable) uses a default sensitivity level that may be too aggressive, causing false positives on legitimate traffic. By lowering the sensitivity level or excluding specific request attributes (e.g., headers, cookies, or URI paths), you can reduce false positives while still blocking actual SQL injection attempts. Cloud Armor allows fine-tuning of preconfigured rules via the `sensitivity` parameter and `exclude` lists, which is the correct approach here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a rate-based rule to limit the number of requests per second.
Why it's wrong here
Rate limiting won't fix false positives for SQLi.
- ✗
Create a rule with higher priority to allow the legitimate traffic before the WAF rule.
Why it's wrong here
Allow rules with higher priority can override, but that would allow all traffic unless very specific.
- ✓
Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.
Why this is correct
Reducing sensitivity reduces false positives.
- ✗
Enable TLS inspection for the load balancer to fully inspect encrypted traffic.
Why it's wrong here
TLS inspection is a separate feature and not directly related to false positives.
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.