AZ-700 · Question #296
You have an Azure subscription that contains 100 network security groups (NSGs). You need to ensure that you log the application of specific NSG rules. Which type of log should you configure?
The correct answer is A. flow log. NSG flow logs record information about IP traffic that is evaluated by NSG rules, including which rule was matched, whether traffic was allowed or denied, source/destination IP, port, and protocol. This is exactly 'logging the application of specific NSG rules.' Activity logs…
Question
You have an Azure subscription that contains 100 network security groups (NSGs). You need to ensure that you log the application of specific NSG rules. Which type of log should you configure?
Options
- Aflow log
- Bactivity log
- CAzure resource log
- Daudit log
How the community answered
(56 responses)- A73% (41)
- B4% (2)
- C14% (8)
- D9% (5)
Explanation
NSG flow logs record information about IP traffic that is evaluated by NSG rules, including which rule was matched, whether traffic was allowed or denied, source/destination IP, port, and protocol. This is exactly 'logging the application of specific NSG rules.' Activity logs capture control-plane events (who created or modified a resource) rather than data-plane traffic decisions. Azure resource logs (diagnostic logs) for NSGs do not provide per-rule traffic hit data. Audit logs are a synonym for activity logs. Flow logs, enabled via Network Watcher, are the correct mechanism.
Community Discussion
No community discussion yet for this question.