PCNE Practice Question: Managing, Monitoring, and Optimising Network Operations
A developer wants to log all denied firewall rule events for security auditing purposes. What is the simplest way to achieve this without modifying existing firewall rules?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a deny-all firewall rule with logging enabled at the lowest priority
Firewall rules logging can be enabled per rule. However, if you want to log all denied traffic without modifying existing rules, you can create a high-priority deny-all rule (e.g., priority 65535) with logging enabled. This will log any traffic not explicitly allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud NAT logging
Why it's wrong here
NAT logging is for NAT connections, not firewall denies.
- ✗
Enable firewall rule logging on existing rules
Why it's wrong here
Enabling logging on existing firewall rules directly contradicts the requirement to achieve this without modifying existing firewall rules, as it necessitates editing each rule individually. This approach would also only log events for rules where logging is explicitly enabled, not all denied events globally. However, this option is tempting because it directly addresses logging and is the correct method when granular logging is needed for specific firewall rules, and modifying those rules is permissible to gain insight into their particular traffic flows.
- ✓
Create a deny-all firewall rule with logging enabled at the lowest priority
Why this is correct
This catches all implicit denies and logs them.
- ✗
Enable VPC Flow Logs on all subnets
Why it's wrong here
Flow Logs log all flows, not just denies, and require configuration.
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.