Firewall rules allow only HTTP, HTTPS, and SSH, but you see no denied entries in firewall logs when testing other ports. How do you capture denied firewall logs?

The correct answer is to create an explicit Deny Any rule and enable logging on it. Google Cloud's implicit deny rule, which denies all traffic not explicitly allowed, does not support logging. To capture denied traffic in firewall logs, you must create your own deny rule with a lower priority than your allow rules (e.g., priority 65534) and enable logging specifically on this new rule. This ensures that any traffic not matched by your allow rules will hit your custom deny rule, and its denial will be logged. Enabling logging on the default Deny Any Firewall Rule is incorrect because the implicit deny rule cannot have logging enabled. Enabling logging on VM instances is incorrect as this refers to guest OS logging, not firewall logging. Creating a logging sink without filters is incorrect because while a sink forwards logs, it doesn't solve the problem of denied traffic not being logged by the implicit deny rule in the first place.