AZ-104 – Question 140


You have an Azure subscription named Subscription1 that has the following providers registered:
✑ Authorization
✑ Automation
✑ Resources
✑ Compute
✑ KeyVault
✑ Network
✑ Storage
✑ Billing
✑ Web
Subscription1 contains an Azure virtual machine named VM1 that has the following configurations:
✑ Private IP address: (dynamic)
✑ Network security group (NSG): NSG1
✑ Public IP address: None
✑ Availability set: AVSet
✑ Subnet:
✑ Managed disks: No
✑ Location: East US
You need to record all the successful and failed connection attempts to VM1.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

  • A. Enable Azure Network Watcher in the East US Azure region.
  • B. Add an Azure Network Watcher connection monitor.
  • C. Register the MicrosoftLogAnalytics provider.
  • D. Create an Azure Storage account.
  • E. Register the Microsoft.Insights resource provider.
  • F. Enable Azure Network Watcher flow logs.

Correct Answer: AEF 
You can log network traffic that flows through an NSG with Network Watcher’s NSG flow log capability.
✑ In the Azure portal, enable Network Watcher
✑ Register Insights provider. NSG flow logging requires the Microsoft.Insights provider.
✑ Enable NSG flow log. NSG flow log data is written to an Azure Storage account, Subscription1 has storage.