AZ-700 · Question #19
You have an Azure virtual network that contains two subnets named Subnet1 and Subnet2. Subnet1 contains a virtual machine named VM1. Subnet2 contains a virtual machine named VM2. You have two…
The correct answer is C. NSG diagnostic. To quickly identify which specific Network Security Group (NSG) rule is blocking connectivity between two virtual machines, the Azure Network Watcher's IP flow verify feature (often referred to as NSG diagnostic) should be utilized.
Question
You have an Azure virtual network that contains two subnets named Subnet1 and Subnet2. Subnet1 contains a virtual machine named VM1. Subnet2 contains a virtual machine named VM2. You have two network security groups (NSGs) named NSG1 and NSG2. NSG1 has 100 inbound security rules and is associated to VM1. NSG2 has 200 inbound security rules and is associated to Subnet1. VM2 cannot connect to VM1. You suspect that an NSG rule blocks connectivity. You need to identify which rule blocks the connection. The issue must be resolved as quickly as possible. Which Azure Network Watcher feature should you use?
Options
- AEffective security rules
- BConnection troubleshoot
- CNSG diagnostic
- DNSG flow logs
How the community answered
(27 responses)- A4% (1)
- B7% (2)
- C70% (19)
- D19% (5)
Why each option
To quickly identify which specific Network Security Group (NSG) rule is blocking connectivity between two virtual machines, the Azure Network Watcher's IP flow verify feature (often referred to as NSG diagnostic) should be utilized.
Effective security rules show all active rules applied to a network interface or subnet but do not actively diagnose whether a particular connection attempt is being blocked or by which specific rule in real-time.
Connection troubleshoot provides a comprehensive connectivity check between two endpoints, including routing and latency, but IP flow verify (NSG diagnostic) is a more direct and quicker tool specifically for identifying NSG rule blocks when an NSG issue is suspected.
The NSG diagnostic feature, specifically known as IP flow verify within Azure Network Watcher, allows you to simulate a packet flow and determine if it's allowed or denied by NSGs. If denied, it precisely identifies the specific NSG and the rule that is blocking the connection, which is crucial for quick resolution when an NSG rule is suspected.
NSG flow logs capture information about IP traffic flows through an NSG for historical analysis and monitoring, but they do not provide an immediate diagnosis of a currently blocking rule for a new connection attempt.
Concept tested: Diagnosing network security group rules with Network Watcher
Source: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview
Topics
Community Discussion
No community discussion yet for this question.