AZ-800 Network Watcher Monitoring 2 — Questions and Answers
Question 1: Which Network Watcher feature captures a short packet trace on a VM without installing an agent?
- Connection Monitor
- Packet Capture (Correct answer)
- IP Flow Verify
- Traffic Analytics
Correct answer: Packet Capture
Packet Capture in Network Watcher initiates a remote capture session on a VM using the Network Watcher extension, requiring no persistent agent.
Question 2: A Network Watcher Connection Monitor probe is reporting 'Unreachable' between two Azure VMs. What is the FIRST diagnostic step?
- Redeploy both VMs
- Check NSG rules on both NICs and subnets (Correct answer)
- Disable Connection Monitor and re-create it
- Increase VM SKU size
Correct answer: Check NSG rules on both NICs and subnets
NSG rules are the most common cause of blocked connectivity between Azure VMs and should be checked first before other remediation steps.
Question 3: Traffic Analytics requires data to be sent to a Log Analytics workspace. What is the minimum recommended data aggregation interval?
- 10 minutes (Correct answer)
- 30 minutes
- 60 minutes
- 24 hours
Correct answer: 10 minutes
Traffic Analytics supports a 10-minute aggregation interval for near-real-time visibility, with 60 minutes as an alternative for cost savings.
Question 4: You need to verify whether a packet from a specific source IP and port is allowed or denied by an NSG without sending real traffic. Which tool do you use?
- Connection Monitor
- Next Hop
- IP Flow Verify (Correct answer)
- Effective Security Rules
Correct answer: IP Flow Verify
IP Flow Verify evaluates NSG rules for a given 5-tuple (IP, port, protocol, direction) and reports whether traffic is allowed or denied.
Question 5: Network Watcher's Next Hop feature returns 'None' for a destination IP. What does this indicate?
- The destination is on the same subnet
- There is no matching route and packets will be dropped (Correct answer)
- Traffic is sent to a network virtual appliance
- The VM has no public IP
Correct answer: There is no matching route and packets will be dropped
A Next Hop result of 'None' means no route matches the destination, so Azure will drop the packets.
Question 6: Which Storage account setting must be configured before enabling NSG flow logs?
- Hierarchical namespace must be enabled
- Soft delete must be disabled
- The storage account must be in the same region as the NSG (Correct answer)
- Shared access signature must be disabled
Correct answer: The storage account must be in the same region as the NSG
NSG flow logs require a storage account in the same Azure region as the NSG to ensure data residency compliance and low-latency writes.
Question 7: In Connection Monitor, what metric indicates the percentage of probes that failed to reach the destination?
- Latency (ms)
- Checks Failed % (Correct answer)
- Jitter (ms)
- Throughput (bps)
Correct answer: Checks Failed %
Checks Failed % represents the proportion of monitoring probes that did not receive a successful response from the destination endpoint.
AZ-800 Network Watcher Monitoring 2
Which Network Watcher feature captures a short packet trace on a VM without installing an agent?