Your gaming service uses private instances behind a global load balancer. You suspect a malicious client IP but aren’t sure and want to investigate with minimal user disruption. What should you do?

The correct option is to create a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs. Cloud Armor is designed for DDoS and WAF protection for services behind a global load balancer. Preview mode allows you to see the impact of a rule without actually enforcing it, which is crucial for investigating a suspicious IP with minimal user disruption. You can then review Cloud Armor logs to confirm if the suspicious IP would have been blocked. VPC Firewall rules operate at the network level and are not suitable for traffic behind a global load balancer, which Cloud Armor protects. Additionally, setting enforcement to disabled for a firewall rule would prevent it from taking any action, while setting it to enabled would immediately block traffic without prior investigation, potentially causing disruption.