Network Watcher for diagnostics in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the primary function of Azure Network Watcher?

Azure Network Watcher helps you monitor and diagnose network issues. What is its main purpose?

A To deploy virtual machines automatically based on network traffic.

B To manage user access and permissions for Azure resources.

C To monitor and diagnose network traffic and connectivity issues in Azure virtual networks.

D To provide backup and disaster recovery for Azure databases.

💡 Hint

Think about what helps you find and fix network problems in Azure.

Azure Network Watcher is designed to monitor and diagnose network traffic and connectivity issues within Azure virtual networks. It does not manage access, deploy VMs, or handle backups.

❓ Configuration

intermediate

Which Azure CLI command enables Network Watcher in a specific region?

You want to enable Network Watcher in the 'eastus' region using Azure CLI. Which command is correct?

A az network watcher enable --location eastus

B az network watcher configure --locations eastus --enabled true

C az network watcher create --location eastus

D az network watcher configure --location eastus --enabled true

💡 Hint

The command uses 'configure' with plural 'locations' and an enabled flag.

The correct command to enable Network Watcher in a region is az network watcher configure --locations eastus --enabled true. Other commands are invalid or do not exist.

❓ Architecture

advanced

Which architecture best supports continuous packet capture with Network Watcher?

You need to capture network packets continuously for a virtual machine in Azure for security analysis. Which architecture setup is best?

A Enable Network Watcher packet capture on the VM's network interface with storage account for saving captures.

B Use Azure Monitor logs only without enabling packet capture.

C Deploy a separate VM to mirror traffic and analyze packets manually.

D Enable Network Security Group flow logs instead of packet capture.

💡 Hint

Packet capture requires enabling on the VM's network interface and storage for data.

Continuous packet capture is done by enabling Network Watcher packet capture on the VM's network interface and saving data to a storage account. NSG flow logs and Azure Monitor logs provide different data types.

❓ security

advanced

What is a security best practice when using Network Watcher packet capture?

When capturing network packets with Network Watcher, what should you do to protect sensitive data?

A Use Network Watcher without any storage to avoid data exposure.

B Share packet capture files publicly for easy access by the team.

C Disable encryption on storage accounts to improve performance.

D Store packet capture files in a secure, access-controlled storage account with encryption enabled.

💡 Hint

Think about how to keep captured data safe and private.

Packet capture files may contain sensitive data. Storing them in a secure, access-controlled, and encrypted storage account protects this data. Public sharing or disabling encryption risks exposure.

🧠 Conceptual

expert

What is the output of this Azure CLI command for Network Watcher troubleshooting?

You run the command:
az network watcher test-connectivity --source-resource-id /subscriptions/123/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1 --dest-address 8.8.8.8 --dest-port 53
What is the expected output type?

A A JSON object showing if the connection to 8.8.8.8 on port 53 succeeded or failed with details.

B A list of all virtual machines in the resource group rg1.

C An error message saying the command is invalid.

D A plain text message confirming Network Watcher is enabled.

💡 Hint

This command tests network connectivity from a VM to an IP and port.

The test-connectivity command returns a JSON object with the connectivity test result, including success or failure and diagnostic details. It does not list VMs or just confirm Network Watcher status.