Question

You manage a Google Cloud Armor security policy attached to a global external Application Load Balancer serving a production e-commerce site. Your security team wants to introduce a new WAF rule that blocks requests matching a broad regular expression, but they are concerned it may inadvertently block legitimate customer traffic. They need to evaluate the real-world impact of the rule against live production traffic before it actually starts denying any requests. What should you configure?

Accepted Answer

Add the rule with the '--preview' flag enabled so matches are logged in Cloud Logging without enforcing the deny action.

Answer

Add the rule with action 'deny(403)' but set the rule to a lower priority than the default rule so it is never evaluated first.

Answer

Deploy the rule in a separate Cloud Armor edge security policy and monitor Adaptive Protection alerts before promoting it.

Answer

Enable Cloud Armor rate limiting in 'throttle' mode so the rule only restricts a percentage of matching requests during testing.