Your DevOps team is investigating intermittent connectivity timeouts and potential egress policy violations between Compute Engine workloads in a production VPC network. You need to enable VPC Flow Logs across the entire network to analyze traffic patterns while strictly controlling Cloud Logging ingestion costs. Your solution must meet the following requirements: Enable flow logging for all subnets across the VPC network with a 30-second aggregation interval. Set a secondary sampling rate of 50% (0.5) to balance visibility with log volume. Annotate flow records with only source and destination instance details (src_instance,dst_instance). Ensure administrative changes to the flow logs configuration are tracked without configuring additional audit policies. Which command should you execute to implement this configuration?

Execute `gcloud network-management vpc-flow-logs-configs create prod-vpc-flow-config --location=global --network=projects/my-prod-proj/global/networks/prod-vpc --aggregation-interval=interval-30-sec --flow-sampling=0.5 --metadata=custom-metadata --metadata-fields=src_instance,dst_instance`: ### What the Network Management VPC Flow Logs Configuration Is The **Network Management API** provides centralized management for VPC Flow Logs configurations across entire VPC networks, organizations, or individual subnets. Creating a configuration using the `gcloud network-management vpc-flow-logs-configs create` command allows administrators to define network-wide telemetry policies with granular control over sampling rates, aggregation intervals, and metadata annotations. ### How it Meets the Requirements - **Network-wide coverage**: Specifying `--network=projects/my-prod-proj/global/networks/prod-vpc` applies flow logging automatically across all present and future subnets in the VPC. - **30-second aggregation window**: Setting `--aggregation-interval=interval-30-sec` batches and aggregates packet metrics over 30-second windows, providing granular visibility while decreasing logging churn. - **50% sampling rate**: Configuring `--flow-sampling=0.5` applies a secondary sampling rate of 50%, halving the volume of generated log entries to control ingestion costs. - **Specific metadata annotations**: Setting `--metadata=custom-metadata` along with `--metadata-fields=src_instance,dst_instance` restricts log record payload attributes strictly to the VM instance names, omitting unneeded fields. - **Automatic administrative tracking**: Creation and modifications via `VpcFlowLogsService` generate **Admin Activity audit logs** (`CreateVpcFlowLogsConfig`, `UpdateVpcFlowLogsConfig`), which are permanently enabled across Google Cloud by default at no extra cost. ### Key Advantages and Capabilities - **Centralized administration**: Eliminates the operational overhead of updating individual subnet configurations independently. - **Optimized storage footprint**: Custom metadata filtering and secondary flow sampling significantly lower Cloud Logging costs. - **Native compliance auditing**: Admin activity calls automatically populate `cloudaudit.googleapis.com/activity` logs without requiring custom Data Access logging policies. - **Comprehensive diagnostics**: Captures network latency metrics and egress/ingress flow paths necessary for debugging connectivity faults. ### Why This Is Optimal Using the Network Management API with custom metadata flags precisely satisfies all observability and cost-optimization constraints while relying on default platform Admin Activity audit logging.

Configure Vpc Flow Logs Network Telemetry | Professional Cloud DevOps Engineer

Configure Vpc Flow Logs Network Telemetry

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your DevOps team is investigating intermittent connectivity timeouts and potential egress policy violations between Compute Engine workloads in a production VPC network. You need to enable VPC Flow Logs across the entire network to analyze traffic patterns while strictly controlling Cloud Logging ingestion costs.

Your solution must meet the following requirements:

Enable flow logging for all subnets across the VPC network with a 30-second aggregation interval.
Set a secondary sampling rate of 50% (0.5) to balance visibility with log volume.
Annotate flow records with only source and destination instance details (src_instance,dst_instance).
Ensure administrative changes to the flow logs configuration are tracked without configuring additional audit policies.

Which command should you execute to implement this configuration?

Execute gcloud network-management vpc-flow-logs-configs create prod-vpc-flow-config --location=global --network=projects/my-prod-proj/global/networks/prod-vpc --aggregation-interval=interval-30-sec --flow-sampling=50 --metadata=exclude-all-metadata --metadata-fields=src_instance,dst_instance

Execute gcloud compute networks subnets update prod-subnet --enable-flow-logs --logging-aggregation-interval=interval-30-sec --logging-flow-sampling=0.5 --logging-metadata=include-all-metadata

Execute gcloud network-management vpc-flow-logs-configs create prod-vpc-flow-config --location=global --network=projects/my-prod-proj/global/networks/prod-vpc --aggregation-interval=interval-30-sec --flow-sampling=0.5 --metadata=custom-metadata --metadata-fields=src_instance,dst_instance and explicitly enable Data Access audit logs for the Network Management API.

Execute gcloud network-management vpc-flow-logs-configs create prod-vpc-flow-config --location=global --network=projects/my-prod-proj/global/networks/prod-vpc --aggregation-interval=interval-30-sec --flow-sampling=0.5 --metadata=custom-metadata --metadata-fields=src_instance,dst_instance

Professional Cloud DevOps Engineer

Configure Vpc Flow Logs Network Telemetry

Related questions