AZ-700 · Question #333
You have an Azure subscription that contains the resources shown in the following table. NSG1 is associated to the NIC of VM1 and contains the rules shown in the following table. You collect NSG…
The correct answer is C. 5. Traffic Analytics aggregates NSG flow log entries by the 5-tuple: source IP, destination IP, source port, destination port, and protocol. Each session in this scenario uses a different source TCP port, so each session produces a distinct 5-tuple and therefore a separate…
Question
You have an Azure subscription that contains the resources shown in the following table. NSG1 is associated to the NIC of VM1 and contains the rules shown in the following table. You collect NSG flow logs for five minutes for the following activities:
- Two RDP sessions from VM1 to VM2, each initiated from a different TCP
port
- Three SSH sessions from VM2 to VM1, each initiated from a different
TCP port You analyze the logs by using Traffic Analytics in Azure Network Watcher. How many aggregated flow entries will Traffic Analytics identify?
Options
- A1
- B2
- C5
- D10
How the community answered
(19 responses)- A5% (1)
- B11% (2)
- C74% (14)
- D11% (2)
Explanation
Traffic Analytics aggregates NSG flow log entries by the 5-tuple: source IP, destination IP, source port, destination port, and protocol. Each session in this scenario uses a different source TCP port, so each session produces a distinct 5-tuple and therefore a separate aggregated flow entry. The 2 RDP sessions (different source ports) = 2 entries, and the 3 SSH sessions (different source ports) = 3 entries, giving 2 + 3 = 5 total aggregated flow entries. If sessions had shared the same source port, they would have been merged into fewer entries.
Community Discussion
No community discussion yet for this question.