AZ-700 Question 274
Single answerYou have an Azure Linux VM in a virtual network that cannot reach an external web service. The virtual network has Network Security Groups (NSGs) at both the subnet and the network interface level. You suspect that an NSG rule might be blocking outbound traffic. You decide to use the IP Flow Verify feature in Azure Network Watcher to troubleshoot. How should you configure and interpret your IP Flow Verify test to determine if the NSG is allowing or denying outbound traffic to the external web service?
- A
Configure the source as the Linux VM's private IP address, the destination as the external service's public IP address, select the appropriate transport protocol and port, and check if the tool reports 'Allowed' or 'Denied'.
- B
Specify the source as the Azure Gateway IP, the destination as the Linux VM's public IP, and run a ping test to see if it fails. A ping failure indicates the outbound NSG denies all traffic.
- C
Run a Network Watcher packet capture on the Linux VM instead of IP Flow Verify, filter by destination port, and check whether the logs show a SYN packet being returned by the external service.
- D
Use IP Flow Verify but set the destination as the Linux VM's loopback address to rule out local firewall issues. Any traffic flow that returns 'Denied' means the VM cannot initiate outbound connections.
Show answer and explanation
Correct answer: A
Explanation
To troubleshoot outbound connectivity issues with Azure VMs, you can use the IP Flow Verify feature in Azure Network Watcher. This tool checks how traffic flows from a specific source IP and port to a destination IP and port. It evaluates whether the flow is 'Allowed' or 'Denied' by reviewing the relevant NSG rules. This helps pinpoint if the NSG is blocking the traffic. For more information, visit the official Microsoft documentation: https://learn.microsoft.com/azure/network-watcher/ip-flow-verify-overview.
- A. Correct.
Correct. IP Flow Verify requires specifying the exact source and destination IP addresses and port numbers to determine whether an outbound flow is allowed or denied by the NSG. By using the private IP of the VM as the source and the public IP of the external service as the destination, you can see if the NSG is blocking outbound traffic. If the tool reports 'Allowed,' the flow is permitted; if it shows 'Denied,' an NSG rule is likely preventing traffic.
- B. Incorrect.
Incorrect. Setting the source to the Azure Gateway IP and the destination to the VM's public IP does not diagnose outbound flows from the VM. A ping test using these addresses would not show whether the outbound flow is blocked by the NSG; it only tests an inbound flow to the VM's public endpoint.
- C. Incorrect.
Incorrect. A packet capture can provide deeper data but is different from using IP Flow Verify. Packet capture does not directly show whether an NSG rule is allowing or denying traffic. You would have to parse the logs manually, whereas IP Flow Verify directly reports NSG behavior.
- D. Incorrect.
Incorrect. Using the VM's loopback address is not appropriate for verifying outbound internet connectivity. The loopback test helps diagnose local issues on the VM but will not reflect NSG rules affecting communication to external services.