Google ACE Practice Question: A network security team wants to capture metadata…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Armor security policies with logging enabled

  Why it's wrong here

  Cloud Armor security policies operate at the Google Cloud load balancer edge and only inspect HTTP(S) requests that pass through that frontend. With logging enabled, you get rule evaluation outcomes (e.g., allow/deny) for those requests, but you never capture raw TCP or UDP flow metadata such as bytes transferred, packet counts, or communication patterns for VM-to-VM traffic or non-HTTP protocols. Thus it lacks the breadth of VPC Flow Logs, which see all network flows at the subnet level.

• ✓

  VPC Flow Logs enabled on the subnet

  Why this is correct

  VPC Flow Logs, when enabled on a subnet, sample and collect metadata about every network flow that touches a VM interface in that subnet, including source/destination IP and port, protocol, bytes sent/received, and timing. These flow records are ingested into Cloud Logging and can be exported to BigQuery or Pub/Sub for anomaly detection, network forensics, or audit purposes. Because they cover all internal and external traffic regardless of protocol, they are the correct choice for connection-level visibility without capturing payloads.

• ✗

  Cloud Packet Mirroring — captures all traffic for deep packet inspection

  Why it's wrong here

  Cloud Packet Mirroring clones the actual packets — including full payloads — and sends them to a collector instance for deep packet inspection (DPI) or security analysis. This is far more resource-intensive and costly than VPC Flow Logs, and it typically requires a mirrored collector deployment and specific forwarding rules. For the exam scenario of troubleshooting connectivity or creating flow-based insights, the payload-level detail is overkill; flow log metadata is sufficient and easier to scale.

• ✗

  Firewall Rules Logging on each firewall rule

  Why it's wrong here

  Firewall Rules Logging only records events where a network flow is evaluated against a firewall rule that has logging enabled, capturing fields like rule name, action (allow/deny), source IP, and destination IP. However, it does not include per-flow metrics such as bytes transferred, flow duration, or packet counts, and it misses traffic that isn't governed by a logged rule (e.g., allowed by implied rules if logging not enabled). It answers 'which rule hit' but not the complete flow profile that VPC Flow Logs provide.

Go deeper

Related to this question