A third‑party cloud WAF proxies HTTPS clients and then opens HTTPS to your global external HTTP(S) load balancer. You must use Cloud Armor to block sessions whose originating client source IP is in IP_RANGE_BLOCK and have Cloud Armor perform the block. How do you configure Cloud Armor?

The correct option specifies a Cloud Armor backend security policy, which is applied to backend services of an external HTTP(S) load balancer. Since a third-party WAF is proxying the traffic, the origin.ip (the immediate client IP seen by the load balancer) will be the WAF's IP. To block based on the original client IP, you must configure userIpRequestHeaders[] in the policy to instruct Cloud Armor to look for the client IP in a specified HTTP header (e.g., X-Forwarded-For). The origin.userip attribute then correctly references this extracted original client IP. The inIpRange() function with origin.userip allows blocking based on the specified IP range. Network edge security policies are for Cloud CDN or external proxy Network Load Balancers, not external HTTP(S) load balancers. Using origin.ip would block the WAF's IP, not the originating client's.