An enterprise hosts an e-commerce platform behind an external Application Load Balancer with an attached Google Cloud Armor security policy. The security engineering team has the following access and threat protection requirements for a backend service: Allow corporate administrators connecting from the CIDR range 198.51.100.0/24 to access administrative endpoints matching request.path.matches('/admin/.*') without being blocked by general WAF inspection. Block all other external clients attempting to access any endpoints under /admin/.*. Inspect all non-admin public traffic against preconfigured WAF rules for SQL injection (sqli-v33-stable) and Cross-Site Scripting (xss-v33-stable), denying matched exploits. Allow all remaining legitimate customer traffic. How should the Cloud Armor security policy rules and priorities be configured to enforce these requirements correctly?

Priority 1000: Allow corporate admin CIDR and `/admin/.*` path. Priority 2000: Deny all other requests matching `/admin/.*`. Priority 3000: Deny requests matching preconfigured SQLi and XSS WAF expressions. Default Rule (2147483647): Allow all traffic.: ### What Google Cloud Armor Security Policies Are **Google Cloud Armor** security policies are edge enforcement controls attached to backend services on external Application Load Balancers. They evaluate incoming HTTP(S) requests using **priority-based rule evaluation** where integer values range from `0` to `2147483646` (with the mandatory default rule fixed at `2147483647`). Rules are evaluated in **ascending numerical order** (lowest priority number evaluated first). When a rule's match condition evaluates to true, Cloud Armor immediately executes the configured action (**allow**, **deny**, or **throttle**) and stops processing further rules. ### How It Meets the Requirements 1. **Corporate Admin Access (Priority 1000)**: Evaluated first. Traffic matching both the IP CIDR `inIpRange(origin.ip, '198.51.100.0/24')` and the L7 path expression `request.path.matches('/admin/.*')` is explicitly granted an **allow** action. Because rule evaluation terminates upon the first match, authorized administrative traffic bypasses downstream WAF evaluations. 2. **Admin Restriction (Priority 2000)**: Evaluated second. Any non-corporate traffic matching `request.path.matches('/admin/.*')` is intercepted and **denied** (HTTP 403/404), ensuring unauthorized clients cannot access administrative endpoints. 3. **OWASP Preconfigured WAF Protection (Priority 3000)**: Evaluated third. General traffic targeting standard customer endpoints is evaluated against preconfigured ModSecurity Core Rule Set expressions (`evaluatePreconfiguredExpr('sqli-v33-stable') || evaluatePreconfiguredExpr('xss-v33-stable')`). Malicious payloads are blocked. 4. **Legitimate Traffic Fallthrough (Default Rule 2147483647)**: Requests that do not match the administrative path and pass WAF inspection reach the default rule set to **allow**. ### Key Advantages * **Deterministic first-match enforcement**: Guarantees privileged access for trusted corporate subnets before general path restrictions or WAF rules execute. * **Defense-in-depth**: Combines Layer 3/4 network filtering (IP allowlists) with Layer 7 contextual filtering (URI paths and ModSecurity CRS rule sets). * **Granular rule precedence**: Avoids false positives on administrative APIs while maintaining strict perimeter security for public-facing assets.

Cloud Armor Security Policy Rule Hierarchy Admin Waf | Professional Cloud Security Engineer

Cloud Armor Security Policy Rule Hierarchy Admin Waf

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise hosts an e-commerce platform behind an external Application Load Balancer with an attached Google Cloud Armor security policy. The security engineering team has the following access and threat protection requirements for a backend service:

Allow corporate administrators connecting from the CIDR range 198.51.100.0/24 to access administrative endpoints matching request.path.matches('/admin/.*') without being blocked by general WAF inspection.
Block all other external clients attempting to access any endpoints under /admin/.*.
Inspect all non-admin public traffic against preconfigured WAF rules for SQL injection (sqli-v33-stable) and Cross-Site Scripting (xss-v33-stable), denying matched exploits.
Allow all remaining legitimate customer traffic.

How should the Cloud Armor security policy rules and priorities be configured to enforce these requirements correctly?

Priority 1000: Deny requests matching preconfigured SQLi and XSS WAF expressions. Priority 2000: Allow corporate admin CIDR and /admin/.* path. Priority 3000: Deny all requests matching /admin/.*. Default Rule (2147483647): Allow all traffic.

Priority 1000: Allow corporate admin CIDR and /admin/.* path. Priority 2000: Deny all other requests matching /admin/.*. Priority 3000: Deny requests matching preconfigured SQLi and XSS WAF expressions. Default Rule (2147483647): Allow all traffic.

Priority 1000: Deny all requests matching /admin/.*. Priority 2000: Allow corporate admin CIDR matching 198.51.100.0/24. Priority 3000: Deny requests matching preconfigured SQLi and XSS WAF expressions. Default Rule (2147483647): Allow all traffic.

Priority 1000: Allow corporate admin CIDR and /admin/.* path. Priority 2000: Deny requests matching preconfigured SQLi and XSS WAF expressions. Priority 3000: Allow all general customer traffic. Default Rule (2147483647): Deny all requests matching /admin/.*.

Professional Cloud Security Engineer

Cloud Armor Security Policy Rule Hierarchy Admin Waf

Related questions