FirstTry

Objective 6.1

PCNE

Configuring Google Cloud Armor policies

Objective 6.1 sits in Configuring, implementing and managing a cloud network security solution, which carries 13% of the Cloud Network Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.

Objective title verbatim from the official objectives. Google Cloud exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

6-1Configuring, implementing and managing a cloud network security solution

A team writes an allow rule and a deny rule that match the same requests, and only one of them ever takes effect. How are the two reconciled?

Both act, with deny taking precedence over allowNo action type is inherently favoured over another.
The highest priority match acts, the rest are skippedCorrect · your answerCorrect. Evaluation halts once a match is found.
The last rule written overrides the earlier onesAuthoring order does not set the evaluation order.
Matching rules are combined into one verdictNothing merges the outcomes of several rules.

Correct.

Concept

Where evaluation stops at the first match, a policy is a decision list rather than a set of accumulating filters, and ordering carries the whole meaning.

Why B

Cloud Armor performs the action of the highest priority rule that matches a request, and rules of lower priority than that match are not evaluated even when their match conditions are identical.

Source

Cloud Armor performs the action of the highest priority rule that matches a request. Rules with a lower priority than the highest priority matching rule are not evaluated, even if they have the same match conditions.

Cloud Armor custom rules language, checked August 2026
#gcp#cloud-armor#priority#rule-evaluation

Now you: objective 6.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

6-1Configuring, implementing and managing a cloud network security solution

An engineer wants one rule to test client region, request path, a header value, the ASN and the TLS fingerprint together. How many subexpressions may one expression hold?

Sample question 2 of 3

6-1Configuring, implementing and managing a cloud network security solution

A team writes rules against the originating client address behind an upstream proxy but never configures the header option in the policy. Which address do those rules evaluate?

Sample question 3 of 3

6-1Configuring, implementing and managing a cloud network security solution

An engineer writes an expression against request.headers['X-Api-Key'] and it never matches, although the header is definitely present. What is wrong with the key?

Full Cloud Network Engineer question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.