You created VPC 'Dev' with one subnet and a firewall rule allowing only HTTP with logging enabled. RDP to an instance fails and no denied firewall entries appear in Cloud Logging. You want to see logs for blocked traffic. What should you do?

The problem states that RDP (TCP/3389) fails and no denied firewall entries appear. This indicates that the existing firewall rules are not explicitly denying the RDP traffic, which means the implicit deny rule is blocking it. The implicit deny rule does not generate logs. To see logs for blocked traffic, you need an explicit deny rule. Creating a deny-all firewall rule with a lower priority (higher number like 65500) than your allow rules ensures it catches all traffic not explicitly allowed. Enabling logging on this rule will then record all denied connections in Cloud Logging. Checking VPC flow logs would show traffic but not specifically why it was denied by a firewall. SSH is a different protocol and won't help diagnose RDP issues. Creating a rule for TCP/22 (SSH) is irrelevant to RDP and won't log denied RDP traffic.