Question

A security team at your company complains that a legacy firewall rule allowing SSH (tcp:22) from a broad source range appears to never take effect, and they suspect it is being overridden by a higher-priority rule. They also want to identify rules that have received zero hits over the past several weeks so they can safely remove them. Which Network Intelligence Center capability should you use to provide both the override analysis and the usage data?

Accepted Answer

Firewall Insights, which reports shadowed rules and provides hit-count metrics over a configurable observation period

Answer

Connectivity Tests, which simulate a packet and return the matched firewall rule for a given 5-tuple

Answer

Firewall Rules Logging combined with Network Topology to visualize traffic flows between instances

Answer

VPC Flow Logs filtered by port 22 in Cloud Monitoring to count SSH connection attempts