AZ-800 Network Watcher Monitoring 5 — Questions and Answers
Question 1: How long are NSG flow logs retained in Azure Storage by default before automatic deletion?
- 7 days
- 30 days
- 0 days (no automatic deletion unless you set a retention policy) (Correct answer)
- 90 days
Correct answer: 0 days (no automatic deletion unless you set a retention policy)
By default, NSG flow logs are never automatically deleted; you must explicitly configure a retention policy (in days) to enable automatic cleanup.
Question 2: Which Network Watcher diagnostic tells you which NSG rule is responsible for allowing or denying a specific flow?
- Next Hop
- Effective Security Rules
- IP Flow Verify (Correct answer)
- Connection Troubleshoot
Correct answer: IP Flow Verify
IP Flow Verify not only returns allow/deny but also names the specific NSG and rule that made the decision for the tested 5-tuple.
Question 3: A company needs to monitor connectivity between 50 Azure VMs in a hub-and-spoke topology. Which Connection Monitor feature reduces the number of test configurations required?
- Single probe groups with multiple sources and destinations (Correct answer)
- Separate test groups per VM pair
- Packet Capture scheduled tasks
- IP Flow Verify batch mode
Correct answer: Single probe groups with multiple sources and destinations
Connection Monitor's test groups allow you to define multiple source and destination endpoints together, generating all pairwise tests automatically.
Question 4: Traffic Analytics shows a high volume of flows from Azure VMs to an unusual external IP late at night. What Azure-native feature can you use to investigate the process making those connections?
- Azure Sentinel hunt queries
- Network Watcher Packet Capture combined with a Wireshark filter (Correct answer)
- Azure Policy compliance scan
- Azure Advisor recommendations
Correct answer: Network Watcher Packet Capture combined with a Wireshark filter
Packet Capture can record the suspicious traffic and filtering in Wireshark by the external IP reveals the specific packets and potentially application-layer data.
Question 5: Which Network Watcher feature generates a visual map showing VNets, subnets, VMs, and their relationships within a subscription?
- Traffic Analytics geo-map
- Topology (Correct answer)
- Connection Monitor dashboard
- Azure Network Manager visualization
Correct answer: Topology
The Topology feature in Network Watcher generates a graphical view of the network resources and their relationships within a selected resource group or VNet.
Question 6: You enable Traffic Analytics but see no data after 24 hours. NSG flow logs are enabled. What is the most likely missing configuration?
- Traffic Analytics requires a Premium Log Analytics workspace
- The flow log storage account is not linked to the Log Analytics workspace in Traffic Analytics settings (Correct answer)
- Traffic Analytics must be enabled per VM, not per NSG
- IPv6 traffic is not supported and blocks processing
Correct answer: The flow log storage account is not linked to the Log Analytics workspace in Traffic Analytics settings
Traffic Analytics requires you to specify a Log Analytics workspace in the flow log configuration; without this link, logs are stored but never processed for analytics.
Question 7: An IP Flow Verify test returns 'Access Allowed' but the application still cannot connect. What should you investigate next?
- The VM's OS firewall (Windows Firewall or iptables) (Correct answer)
- Re-run IP Flow Verify with a different port
- Delete and recreate the NSG
- Upgrade the VNet to a newer gateway SKU
Correct answer: The VM's OS firewall (Windows Firewall or iptables)
IP Flow Verify only checks Azure NSG rules; if traffic is allowed at the NSG level, the OS-level firewall may still be blocking it.
AZ-800 Network Watcher Monitoring 5
How long are NSG flow logs retained in Azure Storage by default before automatic deletion?