AZ-700 Question 65
Select 2Your company has deployed multiple Network Security Groups (NSGs) across different Azure regions, and you need to consolidate NSG flow logs from all regions into a single Log Analytics workspace for unified analysis. After configuring flow logs and traffic analytics, you notice that no logs are being ingested from one specific NSG. Which two configurations should you verify to troubleshoot and resolve this issue?
- A
Ensure that Azure Network Watcher is enabled in the same region as the NSG where logs are not being ingested.
- B
Confirm that the NSG flow logs are set to a flow log version that supports Traffic Analytics (e.g., version 2 or higher).
- C
Install an Azure Network Watcher agent on all VMs protected by the NSG to capture flow logs at the source.
- D
Configure BGP peering on the hub virtual network to allow log forwarding to the Log Analytics workspace.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure NSG flow logs are successfully captured and analyzed, you must enable Network Watcher in the region where the NSG is located, and you must configure the NSG flow log version to one that supports Traffic Analytics (typically version 2). No additional agent installations on VMs are needed for NSG flow logging. For more information, refer to the official documentation here: https://learn.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-overview
- A. Correct.
Correct. Azure Network Watcher must be enabled in each region where you want to monitor NSG logs. If Network Watcher is not active in the region containing the NSG, logs will not be collected or forwarded.
- B. Correct.
Correct. Traffic Analytics requires flow logs set to a version that supports it (such as version 2). Using an unsupported version prevents the ingestion of flow data into Log Analytics.
- C. Incorrect.
Incorrect. Flow logs are captured at the NSG level, and you do not need to install any agent on the VMs themselves for NSG flow logging to work. This is a common misconception.
- D. Incorrect.
Incorrect. Configuring BGP peering has no direct relationship with collecting NSG flow logs or forwarding them to a Log Analytics workspace. Traffic flows, not logs, are affected by routing configurations involving BGP.