AZ-700 Question 270
Single answerYour company has enabled NSG flow logs on a Network Security Group to investigate unauthorized RDP (port 3389) traffic to a virtual machine. You have stored the flow logs in an Azure Storage account and need to confirm if repeated access attempts are being allowed or denied. Which action is the most effective way to interpret this information from the NSG flow logs?
- A
Retrieve the flow logs from the storage account, parse the JSON records to locate flows targeting port 3389, and review the 'flowAction' or 'allowed/denied' field to determine if connections are allowed or blocked.
- B
Check the 'Diagnostic settings' blade for your NSG and look for any critical alerts raised in the 'Activity Logs' section.
- C
Enable just-in-time VM access via Microsoft Defender for Cloud to automatically block all inbound RDP traffic and collect logs from that feature.
- D
Review Azure DNS query logs for the VM� domain name to see if the RDP port has been queried by suspicious IP addresses.
Show answer and explanation
Correct answer: A
Explanation
NSG flow logs provide crucial inbound and outbound traffic details for resources in Azure. They are typically stored in a storage account or directed to Log Analytics. By examining the flow records, you can see which IP addresses attempted to connect, which ports they targeted, and whether the traffic was allowed or denied based on NSG rules. Microsoft� documentation recommends leveraging these logs to investigate unusual traffic patterns, confirm blocked/allowed connections, and enhance security monitoring.
- A. Correct.
Option 1 is correct. NSG flow logs are stored in JSON format and include details about source/destination IPs, ports, and the action (allow or deny). By retrieving the logs from the storage account and examining the flow records, you can identify which connections target port 3389 and whether they have been allowed or denied.
- B. Incorrect.
Option 2 is incorrect because the Activity Logs in Azure primarily track subscription-level or resource-level events such as configuration changes, not the granular traffic details found in flow logs. While you might see NSG rule updates, you won't see per-packet or per-flow traffic patterns in the Activity Logs.
- C. Incorrect.
Option 3 is incorrect because enabling just-in-time VM access is a security feature that restricts management ports, but it does not provide the detailed ingestion and review of raw connection attempts found in NSG flow logs. It can mitigate attacks but is not the direct method for interpreting the existing logs.
- D. Incorrect.
Option 4 is incorrect because Azure DNS query logs track DNS lookup activity, not direct RDP connection attempts. You need NSG flow logs to see the actual traffic flows targeting port 3389 on the VM.