AZ-700 Question 273
Single answerYou have an Azure Virtual Machine named VM1 (IP: 10.0.0.4) in the East US region. It needs to access an internal web server with IP 10.0.1.5 on port 80 (TCP) in the same virtual network. A Network Security Group (NSG) is associated with VM1� subnet. Traffic appears to fail when VM1 attempts to connect to the web server, and you suspect an NSG rule is blocking it. You have Azure Network Watcher enabled in the same region. Which action should you perform to accurately verify the status of this flow?
- A
Use the IP Flow verify feature in Azure Network Watcher, specifying VM1 as the source, 10.0.1.5 as the destination, port 80 (TCP), and verifying the flow.
- B
Create a new Connection Monitor in Network Watcher to continuously probe connectivity from VM1 to 10.0.1.5 on port 80.
- C
Enable NSG flow logs on the subnet and manually review all inbound and outbound traffic to determine if port 80 is blocked.
- D
Log in to VM1 and run a Test-NetConnection to 10.0.1.5 on port 80 to see whether the NSG denies the traffic.
Show answer and explanation
Correct answer: A
Explanation
Using Azure Network Watcher� IP Flow verify feature is the most efficient means to check if an NSG or route is blocking traffic between two resources. It immediately reveals if the flow is allowed or denied without the overhead of analyzing logs or configuring ongoing monitors. For more information, see the official Microsoft documentation on Azure Network Watcher and IP Flow verify.
- A. Correct.
Correct. The IP Flow verify tool in Azure Network Watcher precisely checks whether a flow is allowed or denied based on current NSG rules and routing. By specifying the source VM, destination IP, destination port, and protocol, you immediately see if the flow is permitted or blocked.
- B. Incorrect.
Incorrect. While Connection Monitor can help monitor connectivity over time, it is not as direct for immediate NSG verification. IP Flow verify is specifically designed to show if NSG or routing configurations are blocking a given flow.
- C. Incorrect.
Incorrect. NSG flow logs can eventually give you insight, but they require additional setup, storage accounts, and log analysis. This approach is more time-consuming and less direct for a quick verification of a specific flow.
- D. Incorrect.
Incorrect. Test-NetConnection (or similar commands) can tell you if connectivity fails, but it does not explicitly confirm which NSG rule (if any) is blocking the flow. It won't show the reason for failure the way IP Flow verify does.