A media company needs to block requests that combine a particular header value, a URL path pattern and a specific country. Which Cloud Armor feature supports this kind of logic?
Show answer and explanation
Answer: B
Cloud Armor custom rules write match conditions as Common Expression Language expressions. CEL can combine request attributes such as headers, path, query parameters, geography and source IP with boolean operators in a single rule. That makes it possible to express a condition that requires a header value, a path pattern and a country together. Preconfigured rules are fixed signature sets and cannot be reshaped, while IP-based lists match addresses only.
Why the other options are wrong
- A. Preconfigured WAF rules are fixed signature sets for known attack patterns. They cannot be edited to match a custom combination of header, path and country.
- C. Named IP lists let several policies reference the same addresses. They match only on IP addresses and cannot evaluate headers or paths.
- D. A plain IP allowlist matches source addresses only. It has no way to express conditions on headers, path or geography together.