How to Collect Detailed Cloud Armor WAF Logs for Troubleshooting
Short answer
B Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy to capture detailed WAF rule triggers.
Question
Key Takeaways
This question tests your knowledge of Cloud Armor diagnostic capabilities, where candidates often confuse preview mode (testing) with verbose logging (detailed troubleshooting).
Troubleshooting overly strict Cloud Armor WAF rules requires enabling verbose logging to capture detailed request attributes and rule match reasons. Community experts confirm that setting the Cloud Armor policy log level to VERBOSE is the definitive solution for investigating blocked traffic.
Common mistake: Preview mode (Option C) is frequently selected because it safely tests rules, but it disables enforcement rather than providing the granular request logs needed to identify specific WAF triggers.
Expert Analysis
Why the Answer Is Correct
Enabling verbose logging at the Cloud Armor policy level captures comprehensive request metadata, including the exact rule ID, regex matches, and threat intelligence flags that caused a block. When paired with ALB backend logging, this creates a complete audit trail for security teams. As noted in official documentation, verbose logging is specifically designed for policy creation and troubleshooting phases.
Why the Other Options Are Wrong
Preview mode (Option C) temporarily disables rule enforcement, which risks exposing vulnerable endpoints during an active incident investigation. Log sinks filtering by redirected_by_security_policy (Option D) only capture redirect events, missing the specific WAF rule evaluation details. Backend sampling rates (Option A) control traffic volume sent to backends, not WAF rule diagnostics or security logging granularity.
Community Comment Notes
Multiple high-voted comments validate that verbose logging provides the necessary depth to pinpoint triggering rules without altering enforcement behavior. Users highlight that while preview mode aids testing, it fails to deliver the forensic logs required for root cause analysis. Consensus strongly aligns with Google’s recommendation to use VERBOSE logging exclusively during active troubleshooting [Comment 1, Comment 5].
Official Reference
https://cloud.google.com/armor/docs/verbose-logging
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always distinguish between testing controls (preview mode) and diagnosing controls (verbose logging). For any PCSE scenario requiring deeper visibility into security policy decisions, prioritize explicit logging configurations over behavioral toggles.
Frequently Asked Questions
Why isn't preview mode used for troubleshooting Cloud Armor rules?
Does verbose logging impact production performance in Cloud Armor?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 7 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 7
-
d0fa7d5 👍 4 Answered BI thought B is the correct answer. C is useful for testing the rule, but it doesn’t provide detailed logs. With B, detailed information about which rule caused the block is recorded, which helps in investigating the cause.
-
BPzen 👍 1 Answered COther Rules Still Enforced: Only the specific rules switched to preview mode are not enforced. All other active rules in the Cloud Armor policy continue to block or redirect traffic as configured. This minimizes the exposure since you're not disabling the entire firewall. B. Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy. Cloud Armor policies do not have a "VERBOSE" log level. While enabling logging at the backend captures some information, it does not specifically provide insights into which WAF rules were triggered.
-
cachopo 👍 1 Answered BEnabling verbose logging for your Cloud Armor policy provides the most detailed logs, including information about why specific requests triggered a WAF rule. This level of detail is critical for troubleshooting and refining security policies. - Verbose logging captures detailed request attributes that caused WAF rules to trigger, which are not available in default (normal) logs. - By setting the log level to VERBOSE using the gcloud compute security-policies update command, you can collect the detailed logs needed for investigation.
-
Pime13 👍 1 Answered Bhttps://cloud.google.com/armor/docs/verbose-logging You can adjust the level of detail recorded in your logs. We recommend that you enable verbose logging only when you first create a policy, make changes to a policy, or troubleshoot a policy. If you enable verbose logging, it is in effect for rules in preview mode as well as active (non-previewed) rules during standard operations.
-
nah99 👍 1 Answered BB collects the logs you want. C has the side-effect of allowing the traffic which may not be appropriate during investigation
Show 2 more comments
-
kalbd2212 👍 1C .. This helps you pinpoint the exact rules that are causing problems and understand why they are being triggered.
-
yokoyan 👍 1 Answered BI think it's B.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.