AZ-700 Question 269
Single answerYou are an Azure networking specialist investigating an unusual spike in outbound traffic from a VM within a virtual network. The VM is protected by a Network Security Group (NSG). You have enabled NSG flow logs to determine whether suspicious traffic is being permitted or blocked. Which field in the NSG flow log most directly indicates whether traffic is allowed or denied?
- A
The Resource ID associated with the NSG
- B
The FlowAction field in each flow record
- C
The FlowDirection field in each flow record
- D
The MAC address of the source interface
Show answer and explanation
Correct answer: B
Explanation
When analyzing NSG flow logs, the FlowAction field is crucial for determining whether traffic is permitted (A) or blocked (D). Refer to the Microsoft documentation on NSG flow logs for more details on fields and how to interpret them: https://learn.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-overview.
- A. Incorrect.
Incorrect. The Resource ID references which NSG produced the log, but does not indicate whether traffic is allowed or denied.
- B. Correct.
Correct. The FlowAction field shows whether the traffic is Allowed (A) or Denied (D), making it the best field to confirm permitted or blocked traffic.
- C. Incorrect.
Incorrect. While FlowDirection (Inbound/Outbound) helps you see which way traffic is flowing, it does not show whether the NSG allowed or denied the packets.
- D. Incorrect.
Incorrect. The MAC address information helps identify the source machine at a lower network level, but does not indicate NSG traffic actions.