Cloud Armor Backend Service Preview Logging

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise runs a global e-commerce platform behind a Global external Application Load Balancer with Cloud CDN enabled on its primary backend service. The security team needs to deploy a Google Cloud Armor security policy containing pre-configured WAF rules (such as SQL injection and Cross-Site Scripting mitigation) to protect dynamic endpoints.

To ensure operational readiness without risking disruption to legitimate customer transactions, the team has the following requirements:

Inspect dynamic requests and cache misses arriving at the origin backend service.
Evaluate the impact of new security rules and tune them for false positives against real production traffic before active enforcement.
Ensure that all evaluated requests generate log entries for analysis in Cloud Logging.

Which combination of actions should the security team implement?

Attach the Cloud Armor security policy to the VPC firewall policies associated with the backend VM instances, enable dry-run mode on the firewall rules, and collect VPC Flow Logs.

Attach the Cloud Armor security policy as an edge security policy to the load balancer's frontend forwarding rule, set rule actions to deny, and enable logging on the target HTTPS proxy.

Attach the Cloud Armor security policy to the backend service, enable preview mode on the rules within the policy, and configure the backend service logging sample rate to 1.0 (100%).

Attach the Cloud Armor security policy to the backend service with active deny rules, disable backend service logging to conserve quota, and monitor dropped requests exclusively using Cloud Monitoring metric alerts.

Professional Cloud Security Engineer

Cloud Armor Backend Service Preview Logging

Related questions