AZ-104 Practice Question 49: IP Flow Verify First Step
Microsoft Azure Administrator Associate (AZ-104) · Test 5 · question 9 of 10
A developer reports that vm-app-01 cannot reach vm-sql-01 on TCP 1433. Both VMs are in the same virtual network. vm-sql-01 has a network security group on its network interface and another on its subnet, and between them they carry more than forty rules that several teams have edited.
You want to establish quickly whether a network security group rule is dropping this traffic, and which rule it is, without changing any configuration. What should you do first?
Show answer and explanation
Answer:
IP flow verify answers this exact question in one step: it "check[s] if a packet is allowed or denied to or from an Azure virtual machine based on the configured security and admin rules", and it "looks at the rules of all network security groups applied to a virtual machine's network interface, whether the network security group is associated to the virtual machine's subnet or network interface", so both NSGs in the stem are evaluated together. It takes traffic direction, protocol, local and remote IP, and local and remote port, and it returns "Access denied or Access allowed, the name of the security rule that denies or allows the traffic, and the network security group with a link to it". It reads configuration only, so nothing changes. TCP is supported; ICMP tests need NSG diagnostics instead.
Option A uses the wrong tool. Next hop reports how traffic is *routed*, the next hop type and the route table entry, and says nothing about security rules.
Option B eventually shows the same conclusion but is far slower. Flow logs must be enabled, data has to accumulate and be ingested, and the answer arrives long after IP flow verify would have named the rule.
Option C is a configuration change on a production VM, made blind, and it is ambiguous: the subnet NSG could still be the one blocking, so a failed test would tell you very little.
Reference: IP flow verify overview