Network Watcher for diagnostics in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the primary function of Azure Network Watcher?

Azure Network Watcher helps you monitor and diagnose network issues. What is its main purpose?

A To deploy virtual machines automatically based on network traffic.

B To manage user access and permissions for Azure resources.

C To monitor and diagnose network traffic and connectivity issues in Azure virtual networks.

D To provide backup and disaster recovery for Azure databases.

💡 Hint

Think about what helps you find and fix network problems in Azure.

Azure Network Watcher is designed to monitor and diagnose network traffic and connectivity issues within Azure virtual networks. It does not manage access, deploy VMs, or handle backups.

❓ Configuration

intermediate

Which Azure CLI command enables Network Watcher in a specific region?

You want to enable Network Watcher in the 'eastus' region using Azure CLI. Which command is correct?

A az network watcher enable --location eastus

B az network watcher configure --locations eastus --enabled true

C az network watcher create --location eastus

D az network watcher configure --location eastus --enabled true

💡 Hint

The command uses 'configure' with plural 'locations' and an enabled flag.

The correct command to enable Network Watcher in a region is az network watcher configure --locations eastus --enabled true. Other commands are invalid or do not exist.

❓ Architecture

advanced

Which architecture best supports continuous packet capture with Network Watcher?

You need to capture network packets continuously for a virtual machine in Azure for security analysis. Which architecture setup is best?

A Enable Network Watcher packet capture on the VM's network interface with storage account for saving captures.

B Use Azure Monitor logs only without enabling packet capture.

C Deploy a separate VM to mirror traffic and analyze packets manually.

D Enable Network Security Group flow logs instead of packet capture.

💡 Hint

Packet capture requires enabling on the VM's network interface and storage for data.

Continuous packet capture is done by enabling Network Watcher packet capture on the VM's network interface and saving data to a storage account. NSG flow logs and Azure Monitor logs provide different data types.

❓ security

advanced

What is a security best practice when using Network Watcher packet capture?

When capturing network packets with Network Watcher, what should you do to protect sensitive data?

A Use Network Watcher without any storage to avoid data exposure.

B Share packet capture files publicly for easy access by the team.

C Disable encryption on storage accounts to improve performance.

D Store packet capture files in a secure, access-controlled storage account with encryption enabled.

💡 Hint

Think about how to keep captured data safe and private.

Packet capture files may contain sensitive data. Storing them in a secure, access-controlled, and encrypted storage account protects this data. Public sharing or disabling encryption risks exposure.

🧠 Conceptual

expert

What is the output of this Azure CLI command for Network Watcher troubleshooting?

You run the command:
az network watcher test-connectivity --source-resource-id /subscriptions/123/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1 --dest-address 8.8.8.8 --dest-port 53
What is the expected output type?

A A JSON object showing if the connection to 8.8.8.8 on port 53 succeeded or failed with details.

B A list of all virtual machines in the resource group rg1.

C An error message saying the command is invalid.

D A plain text message confirming Network Watcher is enabled.

💡 Hint

This command tests network connectivity from a VM to an IP and port.

The test-connectivity command returns a JSON object with the connectivity test result, including success or failure and diagnostic details. It does not list VMs or just confirm Network Watcher status.

Practice

1. What is the primary purpose of Azure Network Watcher?

easy

A. To monitor and diagnose network issues in Azure

B. To create virtual machines

C. To manage Azure subscriptions

D. To deploy web applications

Solution

1. Step 1: Understand Network Watcher role

   Network Watcher is designed to monitor and diagnose network problems in Azure environments.

2. Step 2: Compare with other options

   Creating VMs, managing subscriptions, and deploying web apps are unrelated to network diagnostics.

3. Final Answer:

   To monitor and diagnose network issues in Azure -> Option A

4. Quick Check:

   Network Watcher = Monitor and diagnose network issues [OK]

Hint: Network Watcher = network monitoring tool [OK]

Common Mistakes:

• Confusing Network Watcher with VM or app services
• Thinking it manages subscriptions
• Assuming it deploys applications

2. Which Azure resource is required to enable flow logs in Network Watcher?

easy

A. App Service

B. Virtual Machine

C. Storage Account

D. SQL Database

Solution

1. Step 1: Identify flow log storage needs

   Flow logs record network traffic and must be saved somewhere persistent.

2. Step 2: Match resource for storing logs

   Storage Account is used to store flow logs generated by Network Watcher.

3. Final Answer:

   Storage Account -> Option C

4. Quick Check:

   Flow logs need Storage Account [OK]

Hint: Flow logs save data in Storage Account [OK]

Common Mistakes:

• Choosing VM or App Service instead of storage
• Confusing SQL Database with log storage
• Not knowing where logs are saved

3. Given this Azure CLI command to enable flow logs, what will it do?

az network watcher flow-log create --resource-group MyResourceGroup --nsg MyNSG --enabled true --storage-account mystorage

medium

A. Delete flow logs from mystorage

B. Disable flow logs for the NSG

C. Create a new NSG named mystorage

D. Enable flow logs for the NSG and save logs to mystorage

Solution

1. Step 1: Analyze command parameters

   The command enables flow logs (--enabled true) for the NSG named MyNSG in MyResourceGroup.

2. Step 2: Understand storage account usage

   Logs will be saved to the storage account named mystorage as specified.

3. Final Answer:

   Enable flow logs for the NSG and save logs to mystorage -> Option D

4. Quick Check:

   --enabled true + storage-account = enable logs saved [OK]

Hint: Look for --enabled true and storage-account to confirm enabling logs [OK]

Common Mistakes:

• Thinking it disables logs
• Confusing storage account name with NSG
• Assuming it deletes logs

4. You tried to enable flow logs but received an error: "Storage account not found." What is the most likely cause?

medium

A. Network Watcher is disabled in the region

B. The storage account name is misspelled or does not exist

C. The NSG is not created yet

D. Flow logs are already enabled

Solution

1. Step 1: Understand error message

   "Storage account not found" means the specified storage account cannot be located.

2. Step 2: Identify common causes

   Most often this happens if the storage account name is wrong or the account does not exist in the subscription or region.

3. Final Answer:

   The storage account name is misspelled or does not exist -> Option B

4. Quick Check:

   Storage account error = wrong or missing storage account [OK]

Hint: Check storage account name spelling and existence first [OK]

Common Mistakes:

• Assuming NSG or Network Watcher status causes this error
• Thinking flow logs already enabled causes storage error
• Ignoring storage account region or subscription

5. You want to monitor network traffic for multiple NSGs across different regions. Which combination of Azure resources and steps is best practice to set up Network Watcher diagnostics?

hard

A. Enable Network Watcher in each region, create one storage account per region, and configure flow logs for each NSG pointing to its region's storage

B. Create one storage account in any region and configure all NSGs to send flow logs there without enabling Network Watcher in regions

C. Enable Network Watcher only in one region and configure flow logs for NSGs in all regions to that single watcher

D. Use Azure Monitor instead of Network Watcher for NSG flow logs

Solution

1. Step 1: Understand regional scope of Network Watcher

   Network Watcher must be enabled in each Azure region where you want to monitor NSGs.

2. Step 2: Storage account best practice

   Creating a storage account per region reduces latency and complies with data residency rules.

3. Step 3: Configure flow logs per NSG

   Each NSG's flow logs should point to the storage account in its region for efficient storage and retrieval.

4. Final Answer:

   Enable Network Watcher in each region, create one storage account per region, and configure flow logs for each NSG pointing to its region's storage -> Option A

5. Quick Check:

   Regional watchers + regional storage + per-NSG config = best practice [OK]

Hint: Enable watcher and storage per region for best flow log setup [OK]

Common Mistakes:

• Using one watcher or storage for all regions
• Skipping enabling Network Watcher in some regions
• Confusing Azure Monitor with Network Watcher for flow logs