Network Watcher for diagnostics in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable Network Watcher in a specific Azure region.

Azure

az network watcher configure --locations [1] --enabled true

Drag options to blanks, or click blank then click option'

Aeastus

Bwestus2

Ccentralus

Dnorthcentralus

Attempts:

3 left

💡 Hint

Common Mistakes

Using an invalid or misspelled region name.

Omitting the --locations parameter.

The --locations parameter specifies the Azure region where Network Watcher is enabled. Here, westus2 is used as an example region.

2fill in blank

medium

Complete the code to start a packet capture session on a VM's network interface.

Azure

az network watcher packet-capture create --resource-group MyResourceGroup --vm [1] --name MyPacketCapture --time-limit 60

Drag options to blanks, or click blank then click option'

AMyVirtualMachine

BMyNetworkInterface

CMyResourceGroup

DMyStorageAccount

Attempts:

3 left

💡 Hint

Common Mistakes

Using the network interface name instead of the VM name.

Using the resource group or storage account name incorrectly.

The --vm parameter requires the name of the virtual machine where the packet capture will run.

3fill in blank

hard

Fix the error in the command to check IP flow verify between source and destination.

Azure

az network watcher [1] --resource-group MyResourceGroup --vm MyVM --direction Outbound --local-port 80 --remote-port 443 --protocol Tcp

Drag options to blanks, or click blank then click option'

Apacket-capture

Bshow-topology

Cip-flow-verify

Dflow-log

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'show-topology' which only displays network topology.

Using 'packet-capture' which starts packet capture sessions.

The ip-flow-verify command checks if traffic is allowed or denied between source and destination IP addresses and ports.

4fill in blank

hard

Fill both blanks to create a flow log for a Network Security Group (NSG) with logging enabled and retention set.

Azure

az network watcher flow-log create --resource-group MyResourceGroup --nsg [1] --enabled [2] --retention 7

Drag options to blanks, or click blank then click option'

AMyNSG

Btrue

Cfalse

DMyVM

Attempts:

3 left

💡 Hint

Common Mistakes

Using a VM name instead of NSG name.

Setting enabled to false which disables logging.

The --nsg parameter requires the NSG name, and --enabled should be set to true to activate flow logging.

5fill in blank

hard

Fill all three blanks to list all Network Watcher resources in a subscription filtered by location and status.

Azure

az network watcher list --query "[?location=='[1]' && provisioningState=='[2]'].[3]"

Drag options to blanks, or click blank then click option'

Aeastus

BSucceeded

Cname

Dwestus

Attempts:

3 left

💡 Hint

Common Mistakes

Using an incorrect location string.

Using a provisioning state other than 'Succeeded'.

Selecting a property that does not exist.

The query filters Network Watchers by location and provisioningState, then selects the name property to list their names.

Practice

1. What is the primary purpose of Azure Network Watcher?

easy

A. To monitor and diagnose network issues in Azure

B. To create virtual machines

C. To manage Azure subscriptions

D. To deploy web applications

Solution

1. Step 1: Understand Network Watcher role

   Network Watcher is designed to monitor and diagnose network problems in Azure environments.

2. Step 2: Compare with other options

   Creating VMs, managing subscriptions, and deploying web apps are unrelated to network diagnostics.

3. Final Answer:

   To monitor and diagnose network issues in Azure -> Option A

4. Quick Check:

   Network Watcher = Monitor and diagnose network issues [OK]

Hint: Network Watcher = network monitoring tool [OK]

Common Mistakes:

• Confusing Network Watcher with VM or app services
• Thinking it manages subscriptions
• Assuming it deploys applications

2. Which Azure resource is required to enable flow logs in Network Watcher?

easy

A. App Service

B. Virtual Machine

C. Storage Account

D. SQL Database

Solution

1. Step 1: Identify flow log storage needs

   Flow logs record network traffic and must be saved somewhere persistent.

2. Step 2: Match resource for storing logs

   Storage Account is used to store flow logs generated by Network Watcher.

3. Final Answer:

   Storage Account -> Option C

4. Quick Check:

   Flow logs need Storage Account [OK]

Hint: Flow logs save data in Storage Account [OK]

Common Mistakes:

• Choosing VM or App Service instead of storage
• Confusing SQL Database with log storage
• Not knowing where logs are saved

3. Given this Azure CLI command to enable flow logs, what will it do?

az network watcher flow-log create --resource-group MyResourceGroup --nsg MyNSG --enabled true --storage-account mystorage

medium

A. Delete flow logs from mystorage

B. Disable flow logs for the NSG

C. Create a new NSG named mystorage

D. Enable flow logs for the NSG and save logs to mystorage

Solution

1. Step 1: Analyze command parameters

   The command enables flow logs (--enabled true) for the NSG named MyNSG in MyResourceGroup.

2. Step 2: Understand storage account usage

   Logs will be saved to the storage account named mystorage as specified.

3. Final Answer:

   Enable flow logs for the NSG and save logs to mystorage -> Option D

4. Quick Check:

   --enabled true + storage-account = enable logs saved [OK]

Hint: Look for --enabled true and storage-account to confirm enabling logs [OK]

Common Mistakes:

• Thinking it disables logs
• Confusing storage account name with NSG
• Assuming it deletes logs

4. You tried to enable flow logs but received an error: "Storage account not found." What is the most likely cause?

medium

A. Network Watcher is disabled in the region

B. The storage account name is misspelled or does not exist

C. The NSG is not created yet

D. Flow logs are already enabled

Solution

1. Step 1: Understand error message

   "Storage account not found" means the specified storage account cannot be located.

2. Step 2: Identify common causes

   Most often this happens if the storage account name is wrong or the account does not exist in the subscription or region.

3. Final Answer:

   The storage account name is misspelled or does not exist -> Option B

4. Quick Check:

   Storage account error = wrong or missing storage account [OK]

Hint: Check storage account name spelling and existence first [OK]

Common Mistakes:

• Assuming NSG or Network Watcher status causes this error
• Thinking flow logs already enabled causes storage error
• Ignoring storage account region or subscription

5. You want to monitor network traffic for multiple NSGs across different regions. Which combination of Azure resources and steps is best practice to set up Network Watcher diagnostics?

hard

A. Enable Network Watcher in each region, create one storage account per region, and configure flow logs for each NSG pointing to its region's storage

B. Create one storage account in any region and configure all NSGs to send flow logs there without enabling Network Watcher in regions

C. Enable Network Watcher only in one region and configure flow logs for NSGs in all regions to that single watcher

D. Use Azure Monitor instead of Network Watcher for NSG flow logs

Solution

1. Step 1: Understand regional scope of Network Watcher

   Network Watcher must be enabled in each Azure region where you want to monitor NSGs.

2. Step 2: Storage account best practice

   Creating a storage account per region reduces latency and complies with data residency rules.

3. Step 3: Configure flow logs per NSG

   Each NSG's flow logs should point to the storage account in its region for efficient storage and retrieval.

4. Final Answer:

   Enable Network Watcher in each region, create one storage account per region, and configure flow logs for each NSG pointing to its region's storage -> Option A

5. Quick Check:

   Regional watchers + regional storage + per-NSG config = best practice [OK]

Hint: Enable watcher and storage per region for best flow log setup [OK]

Common Mistakes:

• Using one watcher or storage for all regions
• Skipping enabling Network Watcher in some regions
• Confusing Azure Monitor with Network Watcher for flow logs