Using Firewall Insights for Low-Overhead Deny Hit Monitoring

PCNE By islever Editorial Last updated

Configuring and managing NGFW policies and VPC Firewall rules. Using Network Intelligence Center to monitor and troubleshoot common networking issues.

Short answer

A Configure Firewall Rules Logging and use Firewall Insights to display the number of hits without manual dashboard creation.

Question

Your company's security team tends to use managed services when possible. You need to build a dashboard to show the number of deny hits that occur against configured firewall rules without increasing operational overhead. What should you do?
  1. Configure Firewall Rules Logging. Use Firewall Insights to display the number of hits. Correct Answer
  2. Configure Firewall Rules Logging. View the logs in Cloud Logging, and create a custom dashboard in Cloud Monitoring to display the number of hits.
  3. Configure a firewall appliance from the Google Cloud Marketplace. Route all traffic through this appliance, and apply the firewall rules at this layer. Use the firewall appliance to display the number of hits.
  4. Configure Packet Mirroring on the VPC. Apply a filter with an IP address list of the Denied Firewall rules. Configure an intrusion detection system (IDS) appliance as the receiver to display the number of hits.

Key Takeaways

The question tests the distinction between built-in managed insights (Firewall Insights) and custom monitoring solutions, emphasizing that managed services reduce operational overhead.

Learn how to monitor VPC firewall deny hits with minimal operational overhead by using Firewall Insights, a managed service within Google Cloud's Network Intelligence Center.

Common mistake: Choosing Option B (custom dashboard) is common because it offers more flexibility, but it fails the 'minimal operational overhead' requirement compared to the pre-configured Firewall Insights.

Expert Analysis

The core constraint here is minimizing operational overhead while using managed services. Option A leverages Firewall Insights, a feature of the Network Intelligence Center that automatically analyzes firewall logs to provide metrics on rule usage, including deny hits. This requires no custom code or dashboard building.

Option B suggests creating a custom dashboard in Cloud Monitoring. While technically possible, it violates the 'minimal operational overhead' constraint because it requires manual configuration, log queries, and maintenance of the dashboard.

Option C and D involve deploying third-party appliances (Marketplace) or Packet Mirroring with an IDS, which significantly increases operational overhead and contradicts the preference for managed services.

Community comments are divided, with some arguing for B based on flexibility. However, official Google documentation confirms that Firewall Insights provides pre-built views for deny rules. The key insight is that 'managed service' and 'low overhead' point directly to built-in analytics features rather than custom integrations.

Official Reference

https://cloud.google.com/network-intelligence-center/docs/firewall-insights/how-to/view-understand-insights#nic-viewing-deny-rules-24h

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions emphasize 'managed services' or 'minimal operational overhead', prioritize built-in platform features like Cloud Monitoring's pre-built dashboards or Network Intelligence Center tools over custom integrations or third-party appliances. Look for keywords like 'automatic', 'pre-built', or 'out-of-the-box'.

Frequently Asked Questions

What is Firewall Insights?

Firewall Insights is a feature of the Network Intelligence Center that automatically analyzes VPC firewall logs to provide insights into rule usage, including deny hits and overly permissive rules.

Can I create custom dashboards for firewall metrics?

Yes, you can use Cloud Monitoring to create custom dashboards from firewall logs, but this requires more setup and maintenance compared to using the built-in Firewall Insights views.

More PCNE FAQ →

Community Votes

A
67%
B
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 19 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 19

  1. Komal697 👍 7 Answered B
    Option A is a valid approach, but it may increase operational overhead if you need to handle a large volume of logs or if you need to customize the display of the logs. Firewall Rules Logging captures firewall activity logs in real-time, and you can export these logs to other services like Cloud Storage, BigQuery, or Pub/Sub for further analysis. However, you would need to use another service like Firewall Insights to display the number of deny hits, which would require additional configuration and setup.
  2. AzureDP900 👍 6
    A is correct https://cloud.google.com/network-intelligence-center/docs/firewall-insights/concepts/overview
  3. ccieman2016 👍 5 Answered A
    Letter A for me
  4. mohitms1996 👍 4 Answered A
    Firewall Rules Logging is a managed service that logs all firewall rule hits in Cloud Logging. Firewall Insights (a feature of Google Cloud's Network Intelligence Center) analyzes firewall logs automatically and provides insights, including the number of deny hits. Minimal operational overhead since it’s a built-in GCP feature that does not require additional infrastructure. Why not the other options? B. Custom Cloud Monitoring dashboard: While possible, it requires manual setup in Cloud Monitoring, increasing operational overhead. Firewall Insights already provides this data automatically, making option A a more efficient choice.
  5. Komal697 👍 4
    Option B is a better solution because it provides greater flexibility in creating custom dashboards and reports for firewall rule activity logs. Cloud Logging provides a central location for storing, analyzing, and monitoring logs from multiple Google Cloud services, including firewall activity logs. With Cloud Monitoring, you can create custom dashboards and alerts based on the logs' data to monitor and track firewall rules' deny hits. In summary, both options are valid solutions, but option B offers greater flexibility and customization capabilities.
Show 14 more comments
  1. mcjim 👍 4 Answered B
    The correct answer is B as firewall insights doesn't show hits against DENY rules: https://cloud.google.com/network-intelligence-center/docs/firewall-insights/concepts/overview#insights
  2. Andreyv 👍 4 Answered B
    Answer A doesn't describe about creating a dashboard.
  3. didek1986 👍 4 Answered B
    A is missing dashboard
  4. rglearn 👍 3 Answered A
    Technically both A & B are correct but as question demands to have a solution which has less overhead, I would go with Option A
  5. desertlotus1211 👍 2
    Answer is B: https://cloud.google.com/network-intelligence-center/docs/firewall-insights/how-to/view-metrics Look at the bottom of the page... "You can use Monitoring dashboards and their associated charts to visualize the data for the Firewall Insights metrics described in the preceding sections. To monitor these metrics in Monitoring, you can create custom dashboards. You can also add alerts based on these metrics."
  6. mondigo 👍 2
    B. Insights are good for recommendation no dashboards moreover Insight Overly permissive rule insights, including each of the following: Allow rules with no hits Allow rules that are unused based on trend analysis (preview) Allow rules with unused attributes Allow rules with overly permissive IP addresses or port ranges Deny rule insights with no hits during the observation period.
  7. 1f01b87 👍 2 Answered A
    A is correct. https://cloud.google.com/network-intelligence-center/docs/firewall-insights/how-to/view-understand-insights#nic-viewing-deny-rules-24h
  8. gonlafer 👍 2 Answered A
    https://cloud.google.com/network-intelligence-center/docs/firewall-insights/how-to/view-understand-insights#nic-viewing-deny-rules-24h
  9. exambott 👍 2
    B. Firewall insights do not show the number of hits against a deny rule.
  10. gcpengineer 👍 2 Answered A
    Deny rules are covered by fw insights
  11. Rob80205 👍 1 Answered A
    Why Option A is correct: Firewall Insights (a component of the Network Intelligence Center) is a fully managed service designed specifically to minimize operational overhead. Once you enable Firewall Rules Logging, Firewall Insights automatically evaluates the logs and populates a built-in, out-of-the-box dashboard with metrics like Deny rules with hits. You do not have to write custom log queries or manually arrange widgets; the system automatically builds the visual summaries for you
  12. pk349 👍 1
    • A. Configure Firewall Rules Logging. Use Firewall Insights to display the number * of hits. With Firewall Insights metrics, you can perform the following tasks: • Verify that firewall rules are used in an intended way. • Over specified periods, verify that firewall rules allow or block their intended connections.
  13. b6f53d8 👍 1 Answered A
    in question is about manage services, firewall insight are manage in contrary to custom dashboard
  14. mondigo 👍 1
    A is correct, when you enable logging it is possible to see hits for deny rules as well

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Configuring Policy-Based VPN for Non-BGP On-Premises Networks

S-grade

Deploying Packet Mirroring Policies in GCP Regions

S-grade

Troubleshooting Asymmetric Traffic on Google Cloud Interconnect

S-grade

Hub-and-Spoke Centralized Egress with VPC Peering

S-grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide