Microsoft AZ-104 Exam Dumps, Practice Test Questions

Packet capture can help inspect observed traffic but does not directly return the named NSG rule permitting or denying a hypothetical five-tuple. NSG diagnostics simulates the flow and reports the evaluated rule and verdict for the VMSS target.

Effective routes explain the selected next hop, not which NSG rule would allow or deny a given packet. The desired output is a security decision.

Connection Monitor can report reachability failures over time, but an NSG diagnostic evaluation is more direct for identifying the precise security rule responsible for a packet tuple.

Connection monitor reports connectivity health, but a failed probe alone does not list the security admin or NSG rule responsible for rejection.

A NIC allow rule does not bypass every other applicable security rule. Restricting analysis to one layer misses the denied flow.

Next hop helps diagnose route selection but cannot attribute a denied connection to the NSG or Virtual Network Manager rule that blocks it.

The log state E denotes End, for a terminated permitted flow with final statistics. D is the deny state, not a normal session-completion marker. Treating a denied connection as completed would hide a rule-level connectivity failure and overlook the ACL/rule information recorded for the blocked tuple.

The state C denotes Continuing and can include counters on an ongoing permitted flow. D is a separate denial marker, so it is not an indication that periodic traffic totals will continue arriving. Investigate the policy rule and network context instead of using the flow as evidence of a healthy active session.

B represents Begin, when a flow is created and statistics are not yet provided. A tuple marked D is not an unevaluated new connection: it records a deny decision by the evaluated controls. Inspect the related ACL and rule to locate the blocking policy rather than waiting for normal Begin/Continue/End statistics.

IP flow verify answers whether an individual packet would be allowed or denied by NSGs given its five-tuple. That verdict does not inventory the network estate and cannot render the requested architecture relationships across resources.

Connection troubleshoot investigates reachability or failures on a selected source-to-destination network path. This is valuable for diagnosing a specific port, but is not the multi-resource relationship visualization requested for an architecture review.

Packet capture records network frames at specified sources and can reveal retransmissions or protocol behavior. It cannot replace a deployment topology map showing how distinct network resources and their dependencies are connected.

Without filtering or duration constraints, packet capture may collect traffic unrelated to the reported incident. That increases analysis noise and the exposure of unrelated packet data.

Effective routes describe forwarding decisions but do not contain observed packet headers or timing. They cannot provide a filtered packet trace of the intermittent TCP exchange.

A protocol-only filter still captures unrelated TCP flows across the VM and can produce a large, sensitive trace. The incident has an identifiable affected endpoint and port; bounded time, size, endpoint and protocol filters keep the capture relevant and controllable.

Network Watcher is a regional subscription-scoped service rather than a separate engine that must be created for each VM resource group. The number of VNet resource groups does not determine the Network Watcher resource count, and redundant instances are not the supported model.

An NSG is attached to a subnet or NIC for filtering; it does not define how many Network Watcher instances are required. Packet-level diagnostic commands and routing tests use the supported regional service across multiple subnets rather than provisioning a watcher per subnet.

Azure Network Watcher includes Azure-native tools such as IP flow verify, Next hop and packet capture for Azure workloads. It can also diagnose hybrid connections, but those capabilities do not imply the service is restricted to on-premises devices.

DNS read access can help inspect name resolution but cannot enable a Network Watcher effective-rules capability that is unavailable for this endpoint resource type.

The missing view is a documented limitation, not a transient stale-network-object symptom. Recreating the endpoint would interrupt service without providing the requested diagnostic surface.

Private endpoint NICs are platform-managed private network interfaces, not public VM NICs. A public IP does not enable an unsupported effective-rules blade and would undermine the private design.

IP flow verify evaluates NSG rule allowance for a specified packet and point in time. An allow verdict neither measures sustained end-to-end latency nor establishes historical packet loss.

Effective routes show routing decisions, not the packet-loss and round-trip measurements gathered across multiple sampling periods. A valid route can still lead to unstable downstream connectivity.

An on-demand connectivity test can diagnose the current path but does not by itself establish continuous telemetry or multi-day trends. A recurring monitor is required by the stated duration.

NSG priority only orders rules within the NSG evaluation layer. It does not give an ordinary allow rule authority to bypass a separate security-admin deny.

Effective NSG information and IP flow verify can explain an NSG allow, but Azure Virtual Network Manager security-admin rules are an additional higher-precedence layer. An admin Deny can block traffic before ordinary NSG filtering, so the operator must inspect the admin-rule layer separately.

Peering and forwarded-traffic settings influence inter-VNet reachability and routes, but they do not supersede centrally enforced security-admin Deny rules. The source flow is rejected despite an ordinary NSG allow; the rule evaluation of the Network Manager policy remains the decisive layer.

Connection troubleshoot investigates a path or port at test time; it does not aggregate network flow logs into multi-day source/destination traffic analytics.

IP flow verify evaluates an explicit packet’s allow or deny result under current effective rules. It does not ingest a week of VNet flow log records or produce top-talker patterns and aggregate bandwidth history.

VNet flow logs capture network metadata, but the requested trends and top-talker analytics require an associated Traffic Analytics setup and compatible workspace integration.

Next Hop reveals route selection, not whether the gateway forwards correctly, the VM service is listening, or TCP completed. An NSG Allow and a valid route are only parts of end-to-end connectivity diagnosis.

IP flow verify evaluates NSG rule decisions and cannot establish whether the application listener accepts a TCP connection. An Allow finding should be followed with route, gateway, endpoint and transport testing.

NSG verification does not perform a complete end-to-end application exchange. Other failures can persist despite allowed security policy.