Build a minimal-operations dashboard showing the count of denied firewall rule hits.

To build a minimal-operations dashboard for denied firewall rule hits, you should enable Firewall Rules Logging. This sends firewall logs to Cloud Logging. From Cloud Logging, you can then create a custom Cloud Monitoring dashboard. This dashboard can be configured with a log-based metric to count entries where the firewall action was 'DENY', providing a direct view of denied hits. Using Firewall Insights would show insights, but not a real-time count dashboard. Deploying a third-party firewall VM adds operational overhead and cost, which contradicts "minimal-operations." Packet Mirroring is for deep packet inspection and security analysis, not for simple firewall hit counts, and also adds complexity.