AZ-800 - Microsoft Azure Networking Solutions Network Watcher Monitoring Questions and Answers — Questions and Answers
Question 1: A network administrator needs to quickly determine if an inbound traffic flow on TCP port 443 from a specific source IP address is being allowed or denied by the Network Security Groups affecting a particular virtual machine. Which Network Watcher feature provides this specific capability?
- Next Hop
- NSG Flow Logs
- IP Flow Verify (Correct answer)
- Effective Security Rules
Correct answer: IP Flow Verify
IP Flow Verify is a diagnostic tool that checks if a packet with specific 5-tuple information (source/destination IP, source/destination port, protocol) is allowed or denied to or from a VM. It identifies the specific NSG rule responsible for the decision.
Question 2: An administrator is troubleshooting an intermittent connectivity issue between an Azure VM and an on-premises server. They need to continuously monitor the connection to track latency and packet loss over time to identify a pattern. Which Network Watcher tool is best suited for this requirement?
- Packet Capture
- Connection Troubleshoot
- Topology
- Connection Monitor (Correct answer)
Correct answer: Connection Monitor
Connection Monitor is designed for ongoing, long-term monitoring of connectivity and performance between endpoints. It can track changes in reachability and latency over time, which is ideal for diagnosing intermittent issues.
Question 3: A virtual machine in an Azure VNet is unable to reach an on-premises server. The administrator suspects a problem with a User-Defined Route (UDR). To diagnose the issue, they need to determine the exact next hop IP address and route type that Azure is using for traffic from the VM to the on-premises server's IP. Which Network Watcher tool should be used?
- Next Hop (Correct answer)
- IP Flow Verify
- Connection Troubleshoot
- Topology
Correct answer: Next Hop
The Next Hop tool is specifically designed to show the next hop type (e.g., VirtualAppliance, VNetGateway, Internet) and IP address for a given destination from a VM's network interface, based on the effective routes. This directly helps diagnose routing problems.
Question 4: Which of the following is a primary capability of the Network Watcher Packet Capture tool?
- To visualize the routing path between two endpoints.
- To record network traffic to and from a virtual machine for detailed analysis. (Correct answer)
- To continuously monitor network latency and reachability.
- To log all IP traffic decisions made by a Network Security Group.
Correct answer: To record network traffic to and from a virtual machine for detailed analysis.
Packet Capture's main function is to create a session that records network packets to and from a VM. The resulting capture file can be stored and analyzed with tools like Wireshark for deep traffic inspection and troubleshooting.
Question 5: An organization's security policy requires logging all accepted and denied IP traffic that passes through the Network Security Groups associated with their production subnet. This data must be stored in an Azure Storage account for auditing purposes. Which Network Watcher feature must be enabled?
- Packet Capture
- NSG Flow Logs (Correct answer)
- Diagnostic Logs for NSG
- Connection Monitor
Correct answer: NSG Flow Logs
NSG Flow Logs are specifically designed to log 5-tuple information about all IP traffic that is processed by a Network Security Group. This data is sent to an Azure Storage account and is essential for auditing, security analysis, and compliance.
Question 6: A developer reports that they cannot connect from their Azure VM to a specific Azure SQL Database. A network administrator wants to perform a single, comprehensive check to validate connectivity between the VM and the database FQDN, including checks for DNS resolution, NSG rules, and routing. Which Network Watcher tool provides this point-in-time, end-to-end connectivity check?
- IP Flow Verify
- Next Hop
- Connection Troubleshoot (Correct answer)
- Connection Monitor
Correct answer: Connection Troubleshoot
Connection Troubleshoot performs a one-time, point-in-time check between a source and a destination. It provides a detailed report on the connection status, identifies any issues found along the path (like NSG blocks, DNS failures, or routing problems), and measures latency.
AZ-800 - Microsoft Azure Networking Solutions Network Watcher Monitoring Questions and Answers
A network administrator needs to quickly determine if an inbound traffic flow on TCP port 443 from a specific source IP address is being allowed or denied by the Network Security Groups affecting a particular virtual machine.
Which Network Watcher feature provides this specific capability?