AZ-700 Question 68
Single answerAn e-commerce application hosted on an Azure VM in the same region as your customers cannot establish secure outbound connections (TCP port 443) to a critical third-party service. You want to quickly identify whether a Network Security Group (NSG) rule is blocking the outbound traffic to the service� public IP address. Which Azure Network Watcher feature should you use to perform this check?
- A
IP Flow Verify
- B
Traffic Analytics
- C
NSG Flow Logs
- D
Next Hop
Show answer and explanation
Correct answer: A
Explanation
Azure Network Watcher includes multiple diagnostic tools for troubleshooting network connectivity issues. In this scenario, IP Flow Verify is the most efficient feature to quickly confirm whether an NSG is allowing or denying traffic for a specific port and IP address. For references, see Microsoft� documentation on IP Flow Verify: https://learn.microsoft.com/azure/network-watcher/ip-flow-verify-overview
- A. Correct.
Correct. IP Flow Verify specifically checks if outbound and inbound flows from a VM are allowed or denied by an NSG. By entering the VM� IP, the destination IP, the desired port, and protocol, you can immediately see if an NSG rule is blocking the connection.
- B. Incorrect.
Incorrect. Traffic Analytics provides insights into traffic patterns and security threats using NSG Flow Logs. It is useful for aggregated analysis and trending data, but not for a direct, one-off check to see if a specific connection is blocked.
- C. Incorrect.
Incorrect. NSG Flow Logs record all traffic flows through an NSG, but analyzing log files is more time-consuming and less direct for a quick connectivity test. You would need additional tooling or the Logs Analytics workspace to parse and interpret data.
- D. Incorrect.
Incorrect. Next Hop helps identify the next hop in the routing path from a VM to a destination, including if traffic goes to the internet, a VPN gateway, or a specific route. It does not directly tell you if traffic is blocked by an NSG.