Google Professional Cloud Network Engineer Question 365
Single answerGoogle Cloud PlatformYou are managing a Google Cloud project with multiple VMs and have been asked to enable firewall rule logging to monitor ingress traffic for a specific firewall rule. After enabling logging, you notice that no logs are being written to Cloud Logging. What could be the possible reason?
- A
The firewall rule logging feature is not enabled for the specific rule.
- B
The firewall rule is not set to allow traffic, so no logs are generated.
- C
Cloud Logging API is not enabled for the project.
- D
The VM instances do not have the necessary IAM roles to write logs.
Show answer and explanation
Correct answer: C
Explanation
Firewall rule logging requires that the Cloud Logging API is enabled in the project. Without this API, even if logging is enabled for the firewall rule, no logs will appear in Cloud Logging. Other issues, such as traffic type or VM roles, do not prevent log generation in this scenario.
- A. Incorrect.
Incorrect. If the firewall rule logging feature was not enabled, you wouldn't have enabled logging in the first place. This is not the cause of logs being absent.
- B. Incorrect.
Incorrect. Firewall rule logging tracks both allowed and denied traffic. The absence of allowed traffic wouldn't prevent logs from being generated for denied traffic.
- C. Correct.
Correct. If the Cloud Logging API is not enabled for the project, no logs will be written to Logging, even if firewall rule logging is configured correctly.
- D. Incorrect.
Incorrect. VM instances do not need specific IAM roles to write logs. Logs are written by the Google Cloud infrastructure, not the VMs.