Configuring Cloud Logging for API IP Addresses in GCP

PCDOE By islever Editorial Last updated Oct 26, 2026

Managing and analyzing logs.

Short answer

C Enable logging on the firewall rule to deterministically capture the source IP address of every connection accessing the API port.

Question

You are managing an application that runs in Compute Engine. The application uses a custom HTTP server to expose an API that is accessed by other applications through an internal TCP/UDP load balancer. A firewall rule allows access to the API port from 0.0.0.0/0. You need to configure Cloud Logging to log each IP address that accesses the API by using the fewest number of steps. What should you do first?

Enable Packet Mirroring on the VPC.
Install the Ops Agent on the Compute Engine instances.
Enable logging on the firewall rule. Correct Answer
Enable VPC Flow Logs on the subnet.

Key Takeaways

The exam tests the distinction between sampled network telemetry and deterministic security logs, with the common trap being the assumption that VPC Flow Logs provide complete visibility into every connection.

This question addresses the most efficient method to capture source IP addresses for API traffic using Google Cloud's native logging features. It establishes that enabling firewall rule logging is the correct approach over VPC Flow Logs due to sampling limitations.

Common mistake: Many learners select Option D (VPC Flow Logs) because it is a standard networking monitoring tool, failing to recognize that its primary sampling rate means it does not log every single packet or IP address as required by the 'each IP address' constraint.

Expert Analysis

Why the Answer Is Correct

Enabling logging on the firewall rule (Option C) is the optimal first step because it provides a deterministic record of all traffic matching the rule, including the source IP address. Since the requirement is to log "each IP address," a solution that captures every connection is necessary. Firewall logging in Google Cloud records metadata for every packet that matches the rule, ensuring no data is missed due to sampling rates.

Why the Other Options Are Wrong

Option D (VPC Flow Logs) is incorrect because these logs are generated from sampled packets; they do not guarantee that every single connection will be recorded, which violates the strict requirement to log each IP address. Option A (Packet Mirroring) is overly complex and requires additional infrastructure setup, violating the "fewest number of steps" constraint. Option B (Ops Agent) focuses on system-level metrics and application logs rather than network flow details at the infrastructure level.

Community Comment Notes

Community consensus strongly favors Option C. As noted by user maurer, "Enabling logging on the firewall rule... is the best first step." User soady highlighted the critical technical distinction: "IP's can be missed using flow logs" due to dynamic sampling rates. User N_A reinforced this by quoting the official documentation stating that VPC Flow Logs "records a sample of network flows," confirming it cannot satisfy the 'each IP' requirement.

Official Reference

https://cloud.google.com/vpc/docs/flow-logs#when-flow-logs-are-generated

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always read constraints like 'each' or 'all' carefully when comparing sampling-based tools against deterministic logging mechanisms. If the requirement demands 100% coverage of events, prefer Security/Logging rules over Monitoring/Flow logs which typically sample.

Frequently Asked Questions

Why is VPC Flow Logs insufficient for logging each IP address?

VPC Flow Logs use a primary sampling rate that varies based on load, meaning some packets are dropped. This sampling prevents guaranteed logging of every single IP address.

Does enabling firewall logging impact performance significantly?

While firewall logging adds minimal overhead, it is the only native method listed that guarantees logging of every matching packet without requiring agents or complex mirroring setups.

More PCDOE FAQ →

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

PrayasMohanty 👍 7 Answered D

Option D uses fewest number of steps.
soady 👍 4 Answered C

IP's can be missed using flow logs. Right answer is C: VPC Flow Logs samples packets using a primary sampling rate. The primary sampling rate is dynamic and varies depending on the load of the physical host running the VM or gateway at the time of sampling. The probability of sampling any single IP connection increases with the volume of packets. You can't control the primary flow log sampling process or adjust the primary samplSource: https://cloud.google.com/vpc/docs/flow-logs#log-sampling
xhilmi 👍 3 Answered D

Choose option D. To configure Cloud Logging to log each IP address accessing the API with the fewest steps in a Compute Engine environment using an internal TCP/UDP load balancer, the first step would be to enable VPC Flow Logs on the subnet. That will allows you to capture network flow information, including source and destination IP addresses, as traffic passes through the load balancer. VPC Flow Logs provide detailed visibility into network activity without requiring modifications to individual instances or the installation of additional agents. Enabling VPC Flow Logs is a straightforward and efficient way to capture the necessary information for logging IP addresses accessing the API in a Compute Engine environment.
cachopo 👍 3 Answered C

Since there is already a firewall rule allowing access from 0.0.0.0/0, enabling firewall rule logging will capture details of every incoming connection, including the source IP address. This is the simplest approach and requires only one step (enabling logging on the existing firewall rule).
maurer 👍 3 Answered C

Enabling logging on the firewall rule (Option C) is the best first step. It’s a single, direct GCP configuration change. It logs every connection to the API port, capturing the client’s IP address. It requires no changes to the application or additional agents.

Show 9 more comments

winston9 👍 3 Answered C

C is correct. VPC Flows logs can show source IP addresses, but they sample packets, do not provide the level of detail about individual API calls compared to firewall rule logging.
JohnJamesB1212 👍 2 Answered C

The correct option is C: Enable logging on the firewall rule. Explanation: Firewall rule logging allows you to capture the traffic that matches a specific firewall rule, including details such as the source IP address. Since your firewall rule allows access to the API port from 0.0.0.0/0, enabling logging on this rule will log the IP addresses of incoming connections to the API. This is the most straightforward way to log the IP addresses accessing the API using the fewest steps, as it leverages existing firewall configurations and integrates with Cloud Logging. D: VPC Flow Logs provide network-level logging for traffic flowing within the VPC but would log all traffic in the subnet. While it could work, it's a more complex solution compared to enabling firewall rule logging directly. Therefore, C provides the quickest and simplest method to log IP addresses accessing the API.
N_A 👍 2 Answered C

Be careful. The question states "each IP address that accesses the API". VPC Flow Logs is sampling records: "VPC Flow Logs records a sample of network flows sent from and received by VM instances, including instances used as GKE nodes. These logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization." Source: https://cloud.google.com/vpc/docs/using-flow-logs C. Is the correct answer.
ManishKS 👍 2

D. Enable VPC Flow Logs on the subnet. This will capture the network traffic details you need for logging in Cloud Logging without requiring additional configurations on the instances or firewall rules.
abildikar 👍 2 Answered C

VPC logs is sample log collected at intervals
PhilipKoku 👍 2 Answered C

C) Enabling Logging of firewall rules
cachopo 👍 1

A (Enable Packet Mirroring on the VPC): - Packet Mirroring captures entire network packets, which is useful for deep packet inspection but is complex to configure and requires additional analysis tools. - Overhead is high, and it is not needed just to log source IPs. B (Install the Ops Agent on Compute Engine instances): - Ops Agent collects system and application logs, but it won’t automatically log incoming requests unless the custom HTTP server itself logs them. - This would require additional configuration and modifying the application’s logging behavior. D (Enable VPC Flow Logs on the subnet): - VPC Flow Logs capture network-level traffic metadata, including source and destination IPs. - However, this requires additional processing in Cloud Logging to extract IPs accessing the API. - Firewall logging is more straightforward for tracking incoming connections.
gaurav517 👍 1 Answered C

Option C: Enable logging on the firewall rule ✅ Single step: Enable firewall logging ✅ Automatically logs connection metadata including source IP ✅ No additional infrastructure needed ✅ Logs appear in Cloud Logging automatically ✅ Captures all connections matching the firewall rule ✅ Fewest number of steps ✅ Built-in GCP feature Option D: Enable VPC Flow Logs on the subnet ✅ Logs network flows including source/destination IPs ✅ Automatic logging to Cloud Logging ⚠️ More verbose than firewall logs (all traffic, not just API) ⚠️ Higher cost (logs all flows in subnet) ⚠️ Need to filter for specific port/application
BlackCoffee 👍 1 Answered C

The correct answer is C. Enable logging on the firewall rule.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All PCDOE Questions

Access 75 questions with complete answers and detailed explanations.

View Full PCDOE Practice Test →

← Back to PCDOE Study Guide