AZ-800 Network Watcher Monitoring 3 — Questions and Answers
Question 1: A security team wants to analyze traffic patterns across all VNets in a subscription using Network Watcher. Which feature provides topology-aware flow visualization?
- NSG Flow Logs only
- Traffic Analytics with Log Analytics (Correct answer)
- Connection Monitor dashboards
- Azure Monitor Metrics
Correct answer: Traffic Analytics with Log Analytics
Traffic Analytics processes NSG flow logs in Log Analytics and provides geo-maps, top talkers, and topology-aware flow visualization across VNets.
Question 2: Which Network Watcher resource must exist in a region before any regional feature (packet capture, flow logs) can be used there?
- A Network Watcher instance in that region (Correct answer)
- A VPN Gateway in that region
- An Azure Bastion host
- A Log Analytics workspace
Correct answer: A Network Watcher instance in that region
Network Watcher is a regional service; an instance must exist in each region where you want to use features like packet capture or flow logs.
Question 3: You want to capture packets only when a specific TCP port 443 is involved. Which Packet Capture filter option do you configure?
- Set Protocol=TCP and LocalPort=443 (Correct answer)
- Use IP Flow Verify with port 443
- Enable selective capture in Traffic Analytics
- Configure a flow log filter for port 443
Correct answer: Set Protocol=TCP and LocalPort=443
Packet Capture supports per-session filters including protocol and port, allowing you to limit captured traffic to only TCP port 443.
Question 4: NSG flow logs version 2 adds which capability compared to version 1?
- Support for IPv6 addresses
- Throughput information (bytes and packets per flow) (Correct answer)
- Integration with Traffic Analytics
- Multi-region storage support
Correct answer: Throughput information (bytes and packets per flow)
NSG flow log version 2 adds bytes and packets per flow tuple, enabling throughput-based analysis not available in version 1.
Question 5: A VM reports intermittent connectivity issues to an on-premises host over VPN. Which Network Watcher feature would you use to identify packet loss along the path?
- IP Flow Verify
- Connection Troubleshoot (Correct answer)
- Effective Security Rules
- Topology viewer
Correct answer: Connection Troubleshoot
Connection Troubleshoot performs an end-to-end connectivity check and identifies issues like packet loss, latency, and hop-by-hop path details.
Question 6: Traffic Analytics identifies a large volume of malicious flows from a specific external IP. What is the fastest remediation using native Azure tools?
- Delete the affected VNet
- Add a deny rule to the NSG blocking that source IP (Correct answer)
- Disable flow logs to stop recording
- Restart the target VM
Correct answer: Add a deny rule to the NSG blocking that source IP
Adding a deny inbound rule to the NSG for the malicious source IP immediately blocks traffic without service disruption.
Question 7: What is the maximum packet capture file size limit per session in Azure Network Watcher?
- 100 MB
- 500 MB (Correct answer)
- 1 GB
- 5 GB
Correct answer: 500 MB
Azure Network Watcher Packet Capture sessions are limited to a maximum file size of 500 MB per capture session.
AZ-800 Network Watcher Monitoring 3
A security team wants to analyze traffic patterns across all VNets in a subscription using Network Watcher.
Which feature provides topology-aware flow visualization?