AZ-700 Question 266
Single answerYou manage multiple Azure virtual machines protected by different Network Security Groups (NSGs). The security team needs continuous visibility into inbound and outbound traffic flows for troubleshooting and anomaly detection, with advanced insights such as usage trends and potential threats. You have an existing Log Analytics workspace in the same region as the NSGs. Which approach should you take to implement NSG flow logs and enable Traffic Analytics for advanced visualization?
- A
Enable NSG flow logs using Azure Network Watcher, store them in the existing Log Analytics workspace, and enable Traffic Analytics in that workspace, ensuring the NSGs reside in the same region.
- B
Activate NSG flow logs directly from each NSG, export the logs to an Azure Storage account, then manually analyze traffic by downloading the logs from storage.
- C
Enable version 1 of the flow logs for each NSG and forward the flow data to an Event Hub without configuring Azure Network Watcher.
- D
Create a dedicated Log Analytics workspace in every region, enable NSG flow logs at the subscription level, and rely on the default settings for traffic analytics.
Show answer and explanation
Correct answer: A
Explanation
To use NSG flow logs effectively for advanced insights, you must enable them via Azure Network Watcher in the same region where the NSGs reside, choose a valid analytics destination (such as a Log Analytics workspace), and enable Traffic Analytics. Microsoft documentation (https://learn.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-portal) recommends ensuring that the Network Watcher instance and the Log Analytics workspace are set up properly in each region where you want to collect and analyze flow data.
- A. Correct.
Correct. When configuring NSG flow logs for traffic analytics, you must enable them through Azure Network Watcher, choose the existing Log Analytics workspace as the destination, and turn on Traffic Analytics. Both the NSG and the workspace need to be in the same region for data collection and analysis.
- B. Incorrect.
Incorrect. While you can export logs to an Azure Storage account, doing so does not automatically provide advanced analytics like traffic patterns and threat detection. You would need additional tools or services to interpret and visualize the data.
- C. Incorrect.
Incorrect. Version 1 of the flow logs is older and does not provide the same level of detail required for traffic analytics. Also, forwarding logs to an Event Hub alone does not enable built-in traffic analytics in Azure.
- D. Incorrect.
Incorrect. You do not need to create a workspace for each region or enable flow logs at the subscription level. Flow logs are typically enabled per NSG, and Traffic Analytics requires a single workspace in the same region for consolidated logs.