mediumMultiple ChoiceObjective-mapped
Cloud Armor Deny Rule Priority
A company uses Cloud Armor to protect an external HTTPS load balancer. They want to block requests from a specific IP address range 198.51.100.0/24, but allow all other traffic. After creating a deny rule with the source IP condition, they notice that requests from that range are still reaching the backend. What is the most likely cause?
Quick Answer
The answer is that another rule with a lower priority number that allows all traffic is overriding the deny rule. In Cloud Armor, rules are evaluated sequentially based on priority, where a lower numeric value means higher precedence; a rule with priority 1000 allowing all traffic will be matched and enforced before a deny rule with priority 2000, effectively bypassing the intended block. This scenario tests your understanding of Cloud Armor rule evaluation order, a common trap on the Google Professional Cloud Security Engineer exam where candidates mistakenly assume deny rules automatically take effect regardless of priority. The key insight is that Cloud Armor stops evaluating rules as soon as it finds a match, so a broad allow rule with higher precedence will always win over a more specific deny rule with lower precedence. Remember the memory tip: lower number wins the fight, so check your priority ladder before blaming the rule logic.
⚠ Common exam trap
Google Cloud often tests the concept that priority numbers in Cloud Armor are evaluated from lowest to highest, and candidates mistakenly think a deny rule with a higher priority number will take precedence over an allow rule with a lower priority number.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Another rule with a lower priority number that allows all traffic is overriding the deny rule.
In Cloud Armor, rules are evaluated in order of priority, where lower priority numbers indicate higher precedence. If a rule with a lower priority number (e.g., 1000) allows all traffic, it will be evaluated before a deny rule with a higher priority number (e.g., 2000), causing the deny rule to be overridden. This is the most likely reason the specific IP range is still reaching the backend despite the deny rule being created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Another rule with a lower priority number that allows all traffic is overriding the deny rule.
Why this is correct
Rules are evaluated in priority order; lower number wins. A default allow rule with priority 1000 might override a deny rule with higher priority.
- ✗
The rule action is set to 'allow' instead of 'deny'.
Why it's wrong here
If action were 'allow', it would not block traffic. But the scenario says they created a deny rule.
- ✗
Cloud Armor cannot block traffic based on source IP; it only supports geographic and header-based conditions.
Why it's wrong here
Cloud Armor supports source IP filtering.
- ✗
The rule uses the wrong match syntax, such as 'sourceIpRange' instead of 'inIpRange'.
Why it's wrong here
The correct syntax is 'inIpRange'; a wrong syntax would result in a parsing error.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. They want to block requests from a specific malicious IP address range, 203.0.113.0/24. Which Cloud Armor policy configuration should they use?
easy- A.Create an allow rule with source IP condition for their own IP ranges and rely on default deny.
- B.Create a rule with a 'source-ip' tag set to 'malicious' and assign to the load balancer.
- C.Create a deny rule with priority 1000000 for the IP range.
- ✓ D.Create a deny rule with a source IP condition for 203.0.113.0/24 and set priority to 1000.
Why D: Cloud Armor security policies use priority-based rules, where lower numbers indicate higher priority. A deny rule with priority 1000 for the specific IP range 203.0.113.0/24 ensures that traffic from that range is blocked before any lower-priority allow rules are evaluated. This is the standard method to block specific IP ranges while allowing other traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.