AZ-700 Question 272
Single answerYou are an Azure network engineer responsible for diagnosing connectivity issues for a VM running a web application in the East US region. The VM is protected by an NSG that has multiple custom rules. Recently, inbound traffic on port 443 stopped working. You suspect an NSG rule is blocking the traffic and need to determine which rule is affecting the flow. Which of the following methods provides the quickest way to validate whether traffic on port 443 is allowed or denied by the NSG?
- A
Use Azure Network Watcher's IP Flow Verify tool with the VM as the destination, specifying port 443 and the suspected source IP.
- B
Enable Boot Diagnostics on the VM to capture inbound network traffic in the serial console logs.
- C
Enable NSG Flow Logs, store them in a Storage account, and manually analyze the logs for blocked flows.
- D
Redeploy the VM to a different region to see if connectivity is restored.
Show answer and explanation
Correct answer: A
Explanation
Azure Network Watcher's IP Flow Verify is the most direct way to validate traffic relevant to NSG rules. It provides immediate feedback on whether a particular flow is allowed or denied. For more information, refer to the official documentation: https://learn.microsoft.com/azure/network-watcher/ip-flow-verify-overview.
- A. Correct.
Option 1 is correct. IP Flow Verify in Azure Network Watcher allows you to quickly test if a specific flow (source, destination, protocol, and port) is allowed or denied by the current NSG rules without manually analyzing large log files.
- B. Incorrect.
Option 2 is incorrect. Boot Diagnostics helps collect diagnostic information like serial console output and screenshots but does not directly show whether a specific network flow (port 443) is being blocked by an NSG.
- C. Incorrect.
Option 3 is incorrect. NSG Flow Logs can provide detailed logs on allowed or denied traffic, but they take time to generate and must be analyzed in a Storage account or Log Analytics workspace. While informative, this is less efficient for quickly validating a specific flow.
- D. Incorrect.
Option 4 is incorrect. Redeploying the VM to a different region does not address or diagnose the actual NSG rules and is not a recommended approach for troubleshooting a flow issue.