AZ-700 Question 66
Select 2You are troubleshooting network traffic issues in a virtual network protected by an NSG in the West US region. You want to analyze the inbound and outbound flows to isolate connectivity problems. Which two actions must you perform to properly configure NSG Flow Logs using Azure Network Watcher for this scenario?
- A
Enable Network Watcher in the West US region and specify a storage account for the flow logs.
- B
Set up Connection Monitor in the West US region with custom alert rules to capture inbound and outbound flows.
- C
Enable NSG Flow Logs on the target NSG and point them to the specified storage account.
- D
Modify the default NSG rule to allow inbound traffic from any IP address so flow logs can be captured.
Show answer and explanation
Correct answers: A, C
Explanation
To configure NSG Flow Logs in Azure Network Watcher, you first enable the Network Watcher service within the same region as the network security group. Then, specify (or create) a storage account to store log data and enable NSG Flow Logs on the specific NSG. Detailed steps can be found in official Microsoft documentation: https://learn.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-overview.
- A. Correct.
Option 1 is correct. Before you can capture any logs, you must enable Network Watcher in the region containing the NSG. You also need to designate a storage account where the flow log data will be stored.
- B. Incorrect.
Option 2 is incorrect. Connection Monitor helps monitor and track connection states between Azure resources, but it is not designed for capturing inbound and outbound flow logs on an NSG.
- C. Correct.
Option 3 is correct. You must explicitly enable NSG Flow Logs for a specific network security group and configure logs to be sent to a designated storage account.
- D. Incorrect.
Option 4 is incorrect. Enabling flow logs does not require you to change your default NSG rules to allow all inbound traffic. Flow logs capture data based on existing rules without needing to open inbound access from any IP.