You have 10 virtual machines on a single subnet that has a single network security group (NSG). You need to log the network traffic to an Azure Storage account. Which two actions should you perform?…

Question

Options

• AInstall the Network Performance Monitor solution.
• BEnable Azure Network Watcher.
• CEnable diagnostic logging for the NSG.
• DEnable NSG flow logs.
• ECreate an Azure Log Analytics workspace.

• A
  4% (1)
• B
  85% (22)
• C
  8% (2)
• E
  4% (1)

Explanation

Explanation

To log network traffic flowing through an NSG to an Azure Storage account, you must first enable Azure Network Watcher (B), as NSG flow logs are a feature of Network Watcher and cannot function without it being active in the region. Once Network Watcher is enabled, you then enable NSG flow logs (D), which captures information about IP traffic flowing through the NSG and writes it directly to an Azure Storage account - exactly what the question requires.

Why the distractors are wrong:

• A (Network Performance Monitor): This monitors network performance and connectivity between endpoints, not traffic logging to storage.
• C (Diagnostic logging for NSG): NSG diagnostic logs capture rule changes and events, not the actual network traffic flow data.
• E (Log Analytics workspace): While useful for analyzing flow logs, a Log Analytics workspace is not required to log traffic to a Storage account - it's an optional enhancement for querying data.

Memory Tip

Think of it as a two-step ignition: Network Watcher is the key (you must turn it on first), and NSG Flow Logs is the engine (the actual feature doing the work). No key = no engine. Whenever you see "log network traffic" + "NSG" on an exam, immediately think: Network Watcher → Flow Logs.

No community discussion yet for this question.