Google Professional Cloud Network Engineer Question 366
Single answerGoogle Cloud PlatformYou are a network engineer managing a Google Cloud environment. Your organization has requested that you enable firewall rules logging for a specific firewall rule to monitor allowed and denied traffic. After enabling logging, you notice that no logs are being generated in Cloud Logging. What could be the most likely cause of this issue?
- A
The firewall rule does not have the 'logs' action explicitly defined.
- B
The firewall rule is not being matched by any traffic.
- C
Cloud Logging API is not enabled in the project.
- D
Firewall rules logging is only supported for ingress traffic, not egress traffic.
Show answer and explanation
Correct answer: B
Explanation
To generate firewall rules logging, traffic must match the rule for which logging is enabled. If no traffic matches the rule, no logs will be generated. This ensures that logs are only created when the rule is actively applied to traffic, helping to reduce unnecessary logging and associated costs.
- A. Incorrect.
Incorrect. The 'logs' action does not need to be explicitly defined within the firewall rule itself. Logging is enabled at the rule level and does not require additional actions.
- B. Correct.
Correct. If the firewall rule is not being matched by any traffic, no logs will be generated, even if logging is enabled for the rule.
- C. Incorrect.
Incorrect. The Cloud Logging API must be enabled to store logs, but if it were not enabled, you would encounter a different issue (e.g., error messages when enabling logging).
- D. Incorrect.
Incorrect. Firewall rules logging is supported for both ingress and egress traffic, so this statement is false.