How to Collect Detailed Cloud Armor WAF Logs for Troubleshooting

Answer Correct answer: B — Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy to capture detailed WAF rule triggers.

Customers complain about error messages when they access your organization's website. You suspect that the web application firewall rules configured in Cloud Armor are too strict. You want to collect request logs to investigate what triggered the rules and blocked the traffic. What should you do?

Modify the Application Load Balancer backend and increase the tog sample rate to a higher number.
Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy. Correct Answer
Change the configuration of suspicious web application firewall rules in the Cloud Armor policy to preview mode.
Create a log sink with a filter for togs containing redirected_by_security_policy and set a BigQuery dataset as destination.

cloud armor verbose logging troubleshoot waf rules pcse exam practice gcp security logging

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your knowledge of Cloud Armor diagnostic capabilities, where candidates often confuse preview mode (testing) with verbose logging (detailed troubleshooting).

Troubleshooting overly strict Cloud Armor WAF rules requires enabling verbose logging to capture detailed request attributes and rule match reasons. Community experts confirm that setting the Cloud Armor policy log level to VERBOSE is the definitive solution for investigating blocked traffic.

Preview mode (Option C) is frequently selected because it safely tests rules, but it disables enforcement rather than providing the granular request logs needed to identify specific WAF triggers.

Community Discussion (7 comments)

Pime13 👍 1 Selected: B

https://cloud.google.com/armor/docs/verbose-logging You can adjust the level of detail recorded in your logs. We recommend that you enable verbose logging only when you first create a policy, make changes to a policy, or troubleshoot a policy. If you enable verbose logging, it is in effect for rules in preview mode as well as active (non-previewed) rules during standard operations.

cachopo 👍 1 Selected: B

Enabling verbose logging for your Cloud Armor policy provides the most detailed logs, including information about why specific requests triggered a WAF rule. This level of detail is critical for troubleshooting and refining security policies. - Verbose logging captures detailed request attributes that caused WAF rules to trigger, which are not available in default (normal) logs. - By setting the log level to VERBOSE using the gcloud compute security-policies update command, you can collect the detailed logs needed for investigation.

BPzen 👍 1 Selected: C

Other Rules Still Enforced: Only the specific rules switched to preview mode are not enforced. All other active rules in the Cloud Armor policy continue to block or redirect traffic as configured. This minimizes the exposure since you're not disabling the entire firewall. B. Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy. Cloud Armor policies do not have a "VERBOSE" log level. While enabling logging at the backend captures some information, it does not specifically provide insights into which WAF rules were triggered.

nah99 👍 1 Selected: B

B collects the logs you want. C has the side-effect of allowing the traffic which may not be appropriate during investigation

kalbd2212 👍 1

C .. This helps you pinpoint the exact rules that are causing problems and understand why they are being triggered.

d0fa7d5 👍 4 Selected: B

I thought B is the correct answer. C is useful for testing the rule, but it doesn’t provide detailed logs. With B, detailed information about which rule caused the block is recorded, which helps in investigating the cause.

yokoyan 👍 1 Selected: B

I think it's B.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Enabling verbose logging at the Cloud Armor policy level captures comprehensive request metadata, including the exact rule ID, regex matches, and threat intelligence flags that caused a block. When paired with ALB backend logging, this creates a complete audit trail for security teams. As noted in official documentation, verbose logging is specifically designed for policy creation and troubleshooting phases.

Why the Other Options Are Wrong

Preview mode (Option C) temporarily disables rule enforcement, which risks exposing vulnerable endpoints during an active incident investigation. Log sinks filtering by redirected_by_security_policy (Option D) only capture redirect events, missing the specific WAF rule evaluation details. Backend sampling rates (Option A) control traffic volume sent to backends, not WAF rule diagnostics or security logging granularity.

Community Comment Notes

Multiple high-voted comments validate that verbose logging provides the necessary depth to pinpoint triggering rules without altering enforcement behavior. Users highlight that while preview mode aids testing, it fails to deliver the forensic logs required for root cause analysis. Consensus strongly aligns with Google’s recommendation to use VERBOSE logging exclusively during active troubleshooting [Comment 1, Comment 5].

Official Reference

https://cloud.google.com/armor/docs/verbose-logging

Exam Strategy

Always distinguish between testing controls (preview mode) and diagnosing controls (verbose logging). For any PCSE scenario requiring deeper visibility into security policy decisions, prioritize explicit logging configurations over behavioral toggles.

Frequently Asked Questions

Why isn't preview mode used for troubleshooting Cloud Armor rules?

Preview mode disables rule enforcement, which risks exposing your site during an active incident. It is intended for safe testing, not for collecting detailed forensic logs.

Does verbose logging impact production performance in Cloud Armor?

Yes, verbose logging generates significantly more data and may slightly increase latency. It should only be enabled temporarily during troubleshooting or policy validation.

Related Analysis

← Back to PCSE Study Guide