Exam Professional Cloud Network Engineer topic 1 question 215 discussion

I don´t know what the answer is but A and C seem the same to me. As A contain part of the statament"you have recently implemented a security profile with the default set of threat signatures provided by Cloud Next Generation Firewall (Cloud NGFW)"

Deny: logs the threat and drops the packet. https://cloud.google.com/firewall/docs/about-security-profiles#threat-prevention-profile

The most balanced and effective approach seems to align better with A: A. Configure a new default threat signature with Deny All to all severity options. Review the logs to understand the impact. Why A Could Be Correct: Proactive Logging and Review: This option allows you to test and analyze the impact of a more aggressive blocking policy, while simultaneously reviewing logs to fine-tune the security profile before putting it into production. Incremental Improvement: By observing the behavior of the application and understanding what is being blocked, you can avoid negatively affecting legitimate traffic while improving the security posture over time.

Not sure what the right answer is here. But C doesn't make sense as it will drop traffic for ALL severity options, including informational. This could impact legitimate traffic.