Your organization is experiencing a distributed Layer 7 denial-of-service attack targeting backend services behind an external Application Load Balancer. Google Cloud Armor Adaptive Protection generates an alert along with a suggested mitigation rule containing a specific Common Expression Language (CEL) expression. You need to evaluate and remediate this security threat to minimize service risk while ensuring legitimate customer traffic is not inadvertently blocked due to false positives. How should you deploy the suggested recommendation to evaluate its operational impact safely?

Create a security policy rule with the suggested CEL expression, place it in preview mode, and set its priority higher than baseline allow rules.: ### What Cloud Armor Preview Mode and Rule Prioritization Is **Google Cloud Armor Adaptive Protection** detects anomalous Layer 7 traffic patterns and automatically generates suggested security rules containing tailored **Common Expression Language (CEL)** expressions. Deploying a rule in **preview mode** instructs Cloud Armor to evaluate incoming traffic against the rule and write audit logs without taking active enforcement actions (such as dropping or rejecting traffic). ### How It Meets the Requirements - **Evaluate Operational Impact**: Deploying the suggested rule in **preview mode** ensures that DevOps engineers can inspect Cloud Logging entries to observe how much legitimate baseline traffic matches the signature before actively enforcing a deny action. - **Risk Reduction and Safe Mitigation**: Setting the rule to a **higher logical priority** (represented by a lower numerical value) than default or baseline allow rules ensures that when the rule transitions from preview to active enforcement, it intercepts attack traffic before less specific allow rules are evaluated. - **Avoid Outages from False Positives**: Preview mode logs rule triggers without dropping packets, preventing service disruption if the generated signature is overly broad. ### Key Advantages and Capabilities - **Granular Traffic Inspection**: Logs provide visibility into exact request attributes, client IP addresses, and match frequencies. - **Zero-Downtime Validation**: Allows validation of machine-learning-generated signatures against live production traffic without impacting end-user experience. - **Deterministic Evaluation Order**: Cloud Armor processes rules sequentially by numerical priority, stopping evaluation after the first match. - **Multi-Backend Isolation**: Enables teams to determine whether a policy attached to multiple backend services causes unintended side effects on secondary workloads. ### Why This Is Optimal Preview mode provides the necessary balance between rapid threat response and operational safety. It offers definitive telemetry on rule accuracy while preventing catastrophic disruption of valid customer workloads.