AZ-700 Question 67
Single answerYou have deployed a multi-tier application in Azure, and requests from the front-end virtual machine to the back-end virtual machine are timing out. You suspect that a Network Security Group (NSG) rule is blocking traffic. You want to quickly determine if traffic to the back-end VM is allowed or denied, and if denied, identify the specific NSG rule causing the blockage. Which Azure Network Watcher feature should you use first to troubleshoot the NSG configuration?
- A
IP Flow Verify
- B
Next Hop
- C
Connection Monitor
- D
Packet Capture
Show answer and explanation
Correct answer: A
Explanation
Azure Network Watcher� IP Flow Verify feature is specifically designed to confirm whether an NSG rule is allowing or blocking traffic. It highlights which rule applies, streamlining NSG troubleshooting. For more information, refer to Microsoft� documentation on IP Flow Verify (https://learn.microsoft.com/azure/network-watcher/network-watcher-ip-flow-verify-overview).
- A. Correct.
IP Flow Verify is the best option for immediately determining whether NSG rules are blocking traffic. It checks the NSG configuration and lets you see if the traffic is allowed or denied, as well as which specific rule applies.
- B. Incorrect.
Next Hop helps identify the routing path from a VM but does not directly inform you about which NSG rule may be blocking or allowing traffic.
- C. Incorrect.
Connection Monitor provides ongoing monitoring of network connectivity between endpoints, but it is not the most direct way to pinpoint a specific NSG rule that is blocking traffic.
- D. Incorrect.
Packet Capture allows you to record network packets on a VM� NIC. While useful for detailed traffic analysis, it does not directly identify which Network Security Group rule is blocking the traffic.