A security engineer needs evidence of which firewall rule denied a connection. Which approach best fits?

1. Configure Cloud Monitoring policies for the relevant VPN metrics.
2. Enable and analyze VPC Flow Logs.
3. Use Connectivity Tests and interpret its configuration analysis results.
4. Inspect Firewall Rules Logging for the relevant policy and flow.