Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need to test whether…

Question

Options

• AEnable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to
• BConnect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point
• CIn a pre-production environment, disable all firewall rules individually to determine which one is
• DEnable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working

• A
  74% (26)
• B
  14% (5)
• C
  3% (1)
• D
  9% (3)

Explanation

Firewall Rules Logging, when enabled on specific firewall rules, records each connection attempt that matches those rules (both allowed and denied), including the rule that was applied. Using Logs Explorer to analyze these logs directly reveals whether traffic is being permitted or blocked by the recently changed rules - the most targeted and efficient diagnostic approach. VPC Flow Logs (option D) capture traffic volume and flow metadata but do not indicate which specific firewall rule caused a packet to be dropped, making them less useful for pinpointing rule-level issues. Using a bastion host and traffic analyzer (option B) is indirect and complex. Disabling rules individually in pre-production (option C) is slow and may not replicate the exact production configuration that caused the outage.

No community discussion yet for this question.