Network Watcher for diagnostics in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Azure Network Watcher?

Azure Network Watcher is a service that helps you monitor and diagnose conditions at a network level in your Azure environment. It provides tools to check connectivity, capture packets, and view network topology.

beginner

Name two diagnostic tools provided by Network Watcher.

1. Connection Monitor - checks connectivity between resources.
2. IP Flow Verify - checks if traffic is allowed or denied by network security groups.

intermediate

What does the 'Packet Capture' feature in Network Watcher do?

It captures network traffic packets from a virtual machine's network interface for detailed analysis, helping to troubleshoot network issues.

intermediate

How does Network Watcher help with network security?

It verifies if network security group rules allow or block traffic using IP Flow Verify, helping identify misconfigurations or unwanted blocks.

beginner

What is the purpose of the 'Topology' feature in Network Watcher?

It visually displays the network resources and their connections in a region, helping you understand the network layout and dependencies.

Which Azure service helps you monitor and diagnose network issues?

A Azure Monitor

B Network Watcher

C Azure Security Center

D Azure DevOps

Network Watcher is specifically designed for network monitoring and diagnostics.

What does the Connection Monitor tool in Network Watcher do?

A Checks connectivity between resources

B Visualizes network topology

C Captures network packets

D Manages virtual machines

Connection Monitor tests the connectivity between Azure resources.

Which feature helps you see if traffic is allowed or denied by network security groups?

A Packet Capture

B Connection Monitor

C Topology

D IP Flow Verify

IP Flow Verify checks network security group rules for traffic flow.

What is the main use of the Packet Capture feature?

A To capture network traffic for analysis

B To monitor CPU usage

C To create virtual networks

D To manage storage accounts

Packet Capture collects network packets to help diagnose network problems.

What does the Topology feature in Network Watcher show?

A Security alerts

B Billing details

C Network resource connections visually

D Virtual machine logs

Topology provides a visual map of network resources and their connections.

Explain how Azure Network Watcher helps diagnose network connectivity issues.

Think about tools that test connections and analyze traffic.

Describe the benefits of using the Topology feature in Network Watcher.

Imagine looking at a map of your network.

Practice

1. What is the primary purpose of Azure Network Watcher?

easy

A. To monitor and diagnose network issues in Azure

B. To create virtual machines

C. To manage Azure subscriptions

D. To deploy web applications

Solution

1. Step 1: Understand Network Watcher role

   Network Watcher is designed to monitor and diagnose network problems in Azure environments.

2. Step 2: Compare with other options

   Creating VMs, managing subscriptions, and deploying web apps are unrelated to network diagnostics.

3. Final Answer:

   To monitor and diagnose network issues in Azure -> Option A

4. Quick Check:

   Network Watcher = Monitor and diagnose network issues [OK]

Hint: Network Watcher = network monitoring tool [OK]

Common Mistakes:

• Confusing Network Watcher with VM or app services
• Thinking it manages subscriptions
• Assuming it deploys applications

2. Which Azure resource is required to enable flow logs in Network Watcher?

easy

A. App Service

B. Virtual Machine

C. Storage Account

D. SQL Database

Solution

1. Step 1: Identify flow log storage needs

   Flow logs record network traffic and must be saved somewhere persistent.

2. Step 2: Match resource for storing logs

   Storage Account is used to store flow logs generated by Network Watcher.

3. Final Answer:

   Storage Account -> Option C

4. Quick Check:

   Flow logs need Storage Account [OK]

Hint: Flow logs save data in Storage Account [OK]

Common Mistakes:

• Choosing VM or App Service instead of storage
• Confusing SQL Database with log storage
• Not knowing where logs are saved

3. Given this Azure CLI command to enable flow logs, what will it do?

az network watcher flow-log create --resource-group MyResourceGroup --nsg MyNSG --enabled true --storage-account mystorage

medium

A. Delete flow logs from mystorage

B. Disable flow logs for the NSG

C. Create a new NSG named mystorage

D. Enable flow logs for the NSG and save logs to mystorage

Solution

1. Step 1: Analyze command parameters

   The command enables flow logs (--enabled true) for the NSG named MyNSG in MyResourceGroup.

2. Step 2: Understand storage account usage

   Logs will be saved to the storage account named mystorage as specified.

3. Final Answer:

   Enable flow logs for the NSG and save logs to mystorage -> Option D

4. Quick Check:

   --enabled true + storage-account = enable logs saved [OK]

Hint: Look for --enabled true and storage-account to confirm enabling logs [OK]

Common Mistakes:

• Thinking it disables logs
• Confusing storage account name with NSG
• Assuming it deletes logs

4. You tried to enable flow logs but received an error: "Storage account not found." What is the most likely cause?

medium

A. Network Watcher is disabled in the region

B. The storage account name is misspelled or does not exist

C. The NSG is not created yet

D. Flow logs are already enabled

Solution

1. Step 1: Understand error message

   "Storage account not found" means the specified storage account cannot be located.

2. Step 2: Identify common causes

   Most often this happens if the storage account name is wrong or the account does not exist in the subscription or region.

3. Final Answer:

   The storage account name is misspelled or does not exist -> Option B

4. Quick Check:

   Storage account error = wrong or missing storage account [OK]

Hint: Check storage account name spelling and existence first [OK]

Common Mistakes:

• Assuming NSG or Network Watcher status causes this error
• Thinking flow logs already enabled causes storage error
• Ignoring storage account region or subscription

5. You want to monitor network traffic for multiple NSGs across different regions. Which combination of Azure resources and steps is best practice to set up Network Watcher diagnostics?

hard

A. Enable Network Watcher in each region, create one storage account per region, and configure flow logs for each NSG pointing to its region's storage

B. Create one storage account in any region and configure all NSGs to send flow logs there without enabling Network Watcher in regions

C. Enable Network Watcher only in one region and configure flow logs for NSGs in all regions to that single watcher

D. Use Azure Monitor instead of Network Watcher for NSG flow logs

Solution

1. Step 1: Understand regional scope of Network Watcher

   Network Watcher must be enabled in each Azure region where you want to monitor NSGs.

2. Step 2: Storage account best practice

   Creating a storage account per region reduces latency and complies with data residency rules.

3. Step 3: Configure flow logs per NSG

   Each NSG's flow logs should point to the storage account in its region for efficient storage and retrieval.

4. Final Answer:

   Enable Network Watcher in each region, create one storage account per region, and configure flow logs for each NSG pointing to its region's storage -> Option A

5. Quick Check:

   Regional watchers + regional storage + per-NSG config = best practice [OK]

Hint: Enable watcher and storage per region for best flow log setup [OK]

Common Mistakes:

• Using one watcher or storage for all regions
• Skipping enabling Network Watcher in some regions
• Confusing Azure Monitor with Network Watcher for flow logs