As someone who teaches the CCSA class I think I can provide some insight here.
In the CCSA R80 class, there was a question like this and the answer was "up to two" ordered layers. At the time only R77.30 gateways were available and this was correct, due to gateway limitations you could not have more than two Access Control Policy ordered layers (Network & APCL/URLF).
However in the CCSA R80.10 courseware, the answer was changed to "one or more ordered layers" due to the availability of R80.10 gateways. With R80.10 gateway there could now be more than two ordered layers in the Access Control Policy. However for an R77.30 gateway managed with R80+, the answer is still "up to two" ordered layers.
The question needs to be clarified with context as to the gateway version, so I'm mentioning certification manager Jason Tugwell in the hope that he'll see this thread.
--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com