Microsoft Certified: Azure Administrator AssociateImplement and manage virtual networkingMedium
A company is deploying a highly sensitive application on Azure Virtual Machines (VMs). The security team requires that all network traffic to and from these VMs be logged for auditing and security analysis. You need to implement a solution to capture and store this network traffic. Which Azure networking feature should you configure?
- ANetwork Security Group (NSG) Flow Logs
- BAzure Network Watcher Connection Monitor
- CAzure Firewall Diagnostic Logs
- DAzure Monitor Activity Log
Show answer & explanationAnswer & explanation
Correct answer: A. Network Security Group (NSG) Flow Logs
NSG Flow Logs, a feature of Azure Network Watcher, record information about IP traffic flowing through an NSG. This includes source/destination IP, port, protocol, and whether traffic was allowed or denied, making it ideal for auditing and security analysis of VM network traffic.
Why the other options are wrong
- B. Azure Network Watcher Connection Monitor checks connectivity between two endpoints. It's for troubleshooting connectivity issues, not for logging all network traffic flows.
- C. Azure Firewall Diagnostic Logs capture logs from an Azure Firewall. While useful for firewall traffic, they only cover traffic passing through the firewall, not all traffic to/from specific VMs if not all traffic is routed through the firewall.
- D. Azure Monitor Activity Log provides insights into subscription-level events (e.g., resource creation, deletion), not granular IP traffic flows to/from VMs.
NSG Flow Logs
A feature of Azure Network Watcher that logs information about IP traffic flowing through a Network Security Group (NSG), providing details like source/destination IP, port, protocol, and traffic action.
- Enables deep network visibility for auditing and security.
- Logs are stored in Azure Storage accounts.
- Can be analyzed with tools like Network Watcher traffic analytics or Azure Log Analytics.
Memory trick: Flow Logs: Your network's detailed diary.