A network team must verify which firewall rule allowed or denied a specific supported flow before changing policy. Which approach best fits?

1. Use supported service-account targeting in firewall rules.
2. Rely on connection tracking for permitted return traffic, subject to supported firewall behavior.
3. Use a supported Packet Mirroring configuration and a controlled collector.
4. Enable and inspect Firewall Rules Logging for the relevant rule.