tests/NetworkSecurityConfigTest/res/xml/nested_domains_override.xml

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
    </base-config>
    <!-- Nested config that overrides parent -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">android.com</domain>
        <domain-config cleartextTrafficPermitted="false">
            <domain>developer.android.com</domain>
        </domain-config>
    </domain-config>
</network-security-config>