AZ-500 Question 70
Single answerYour company has several Azure virtual machines (VMs) spread across different subnets, each protected by its own Network Security Group (NSG). You suspect that certain external IP addresses are sending unusually high volumes of inbound traffic to these VMs, potentially indicating malicious activity. You need to confirm whether the NSGs are allowing or blocking the connections from these suspicious IP addresses, and then analyze the traffic data. Which feature of Azure Network Watcher should you use to obtain detailed logs of all inbound and outbound traffic for further analysis?
- A
IP Flow Verify
- B
Network Performance Monitor
- C
NSG Flow Logs
- D
Packet Capture
Show answer and explanation
Correct answer: C
Explanation
NSG Flow Logs are specifically designed for auditing and monitoring all network traffic passing through an NSG, whether allowed or denied. Once enabled, the logs can be stored in a supported storage account or sent to Log Analytics for deeper analysis. This capability is particularly useful when investigating suspicious inbound requests and validating security rules. For more information, refer to Microsoft’s official documentation on NSG Flow Logs: https://docs.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-overview.
- A. Incorrect.
IP Flow Verify is useful for on-demand checks to see if traffic from a specific source to a specific destination is allowed or blocked, but it does not provide ongoing inbound/outbound traffic logs.
- B. Incorrect.
Network Performance Monitor (NPM) helps track and troubleshoot end-to-end network performance and connectivity issues across networks, not detailed inbound/outbound traffic flows at the NSG level.
- C. Correct.
NSG Flow Logs record both allowed and denied inbound/outbound traffic through an NSG, providing the detailed data needed to analyze suspicious inbound traffic patterns.
- D. Incorrect.
Packet Capture gathers real-time packet-level details but is typically used for short-term deep analysis or debugging. It does not provide an aggregated view of all traffic flows in the same way NSG Flow Logs do.