AZ-500 Question 71
Single answerYou have an Azure VM that is not receiving inbound traffic from a specific on-premises IP address. You suspect that a Network Security Group (NSG) rule is blocking the traffic. Which Network Watcher feature should you use first to quickly determine if traffic from that IP address is allowed or denied by the NSG?
- A
Use the IP Flow Verify feature in Network Watcher to check if incoming traffic from the on-premises IP is allowed or denied.
- B
Use the Next Hop feature in Network Watcher to identify the next routing hop for inbound traffic from the on-premises IP.
- C
Set up a Connection Monitor to test connectivity from the on-premises IP address to the VM and track results over time.
- D
Enable Packet Capture on the VM's network interface to analyze network packets in real-time.
Show answer and explanation
Correct answer: A
Explanation
IP Flow Verify (part of Network Watcher) is the fastest way to confirm if a specific inbound or outbound flow is blocked by an NSG. By specifying source and destination details, you immediately see if the configured NSG rules are allowing or denying the traffic. For more information, refer to Microsoft's documentation on Network Watcher, specifically the IP Flow Verify feature: https://learn.microsoft.com/azure/network-watcher/network-watcher-ip-flow-verify
- A. Correct.
Correct: IP Flow Verify is specifically designed to quickly determine if an NSG (or other configurations) is allowing or denying traffic by specifying the source and destination IP addresses and ports. It provides immediate feedback on whether inbound or outbound traffic is blocked.
- B. Incorrect.
Incorrect: Next Hop is used to determine the next router or hop in the path for a given VM’s outbound traffic. It does not focus on whether an NSG rule is allowing or blocking the traffic.
- C. Incorrect.
Incorrect: Connection Monitor is useful for ongoing end-to-end connectivity monitoring, but it is not the most direct way to see if an NSG rule is blocking a specific inbound IP address. It’s more appropriate for continuous testing and alerting on connectivity status.
- D. Incorrect.
Incorrect: Packet Capture is for deep packet inspection on a VM’s network interface. While it can provide raw data on traffic, it’s more complex to set up and analyze than IP Flow Verify when the goal is to quickly confirm if an NSG rule is blocking inbound traffic.