Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ41

Managing operations

Customers report error messages when they access your organization's website. You suspect the web application firewall rules configured in Cloud Armor are overly strict. You want to gather request logs to investigate what triggered the rules and blocked the traffic. What should you do?

  • A Modify the Application Load Balancer backend and increase the tog sample rate to a higher number.
  • B Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy.
  • C Change the configuration of suspicious web application firewall rules in the Cloud Armor policy to preview mode.
  • D Create a log sink with a filter for togs containing redirected_by_security_policy and set a BigQuery dataset as destination.
Explanation

Cloud Armor request logging is part of external Application Load Balancer logging, so logging must be enabled on the protected backend service. Setting the Cloud Armor policy log level to VERBOSE adds the request details needed to troubleshoot which content triggered preconfigured WAF rules, while retaining logs of the enforcement outcome.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!