Azure Network Watcher IP Flow Verify vs Traffic Analytics

AZ-305 Last updated

Design network solutions

Short answer

B Azure Traffic Analytics analyzes aggregated traffic flows and does not verify individual packet allow/deny decisions; IP Flow Verify is required.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Traffic Analytics in Azure Network Watcher to analyze the network traffic. Does this meet the goal?

  1. Yes
  2. No Correct Answer

Key Takeaways

The exam tests knowledge of Azure Network Watcher tools, with the common trap being confusion between high-level traffic analytics (aggregated data) and low-level flow verification (per-packet decision logic).

This question evaluates the distinction between Azure Traffic Analytics and IP Flow Verify in Azure Network Watcher for packet-level diagnostics. It establishes that only IP Flow Verify can determine if specific packets are allowed or denied by security rules.

Common mistake: Candidates often select 'Yes' because they associate NSG flow logs with Traffic Analytics and assume this covers packet allow/deny status. However, Traffic Analytics visualizes aggregated flows, whereas IP Flow Verify explicitly checks individual packet permissions against NSG rules.

Expert Analysis

Why the Answer Is Correct

The correct answer is B because Azure Traffic Analytics provides statistical insights and visualization of network traffic patterns, such as total inbound/outbound flows and NSG deployment status. It does not perform real-time checks on individual packets to determine if they are allowed or denied. The tool required for this specific goal is IP Flow Verify, which "checks if a packet is allowed or denied to or from a virtual machine" by evaluating it against configured Network Security Group (NSG) rules.

Why the Other Options Are Wrong

Option A is incorrect because selecting 'Yes' implies Traffic Analytics meets the goal, which it does not. While Traffic Analytics uses NSG flow logs, it aggregates this data for trend analysis and troubleshooting performance issues, not for immediate packet-level permit/deny verification. Confusing these two capabilities leads to choosing the wrong diagnostic tool.

Community Comment Notes

Community consensus strongly favors Option B. As user itmaster noted, "Traffic Analytics... gives you statistical data... However, it doesn't give you information if packets are allows of denied." Several users referenced official documentation stating that "IP flow verify checks if a packet is allowed or denied to or from a virtual machine," confirming that Traffic Analytics is insufficient for this specific requirement. User ExStudent also emphasized that IP Flow Verify returns the name of the rule that denied the packet, a feature absent in Traffic Analytics.

Official Reference

Exam Strategy

When asked about checking if a specific packet is allowed or denied, always look for IP Flow Verify in Azure Network Watcher. Reserve Traffic Analytics for questions involving traffic volume, trends, or aggregated NSG flow log analysis.

Frequently Asked Questions

What is the difference between Traffic Analytics and IP Flow Verify?

Traffic Analytics visualizes aggregated network flow data and trends. IP Flow Verify checks a single packet against NSG rules to see if it is allowed or denied.

Can Traffic Analytics show blocked traffic?

It shows statistics on blocked flows via NSG flow logs but cannot verify if a specific new packet is allowed or denied in real-time.

More AZ-305 FAQ →

Discussion 33 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 30 of 33

  1. itmaster 👍 69 Answered B
    (Traffic Analytics) under (Network Watcher) gives you statistical data and traffic visualization like total inbound and outbound flows and the number of deployed NSGs. However, it doesn't give you information if packets are allows of denied. Check screenshot in the following reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics (IP Flow Verify) under (Network Watcher) gives you option to verify if traffic is allowed or denied. Check screenshot in the following reference: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview Correct answer is B.
  2. Eltooth 👍 12 Answered B
    Correct answer - B
  3. NotMeAnyWay 👍 5 Answered B
    Azure Traffic Analytics is designed to help diagnose performance and connectivity issues in Azure virtual networks. It uses network flow data collected by Azure Network Watcher's flow logs, and provides insights into network activity and patterns. However, it does not provide the ability to identify whether packets are being allowed or denied to specific virtual machines.
  4. sapien45 👍 4
    Answer:A Read the damn docuemntation : https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics A key component of traffic analytics is NSG flow logs : Network security group (NSG) flow logs: Allow you to view information about ingress and egress IP traffic through a network security group. NSG flow logs are written in json format and show outbound and inbound flows on a per rule basis, the NIC the flow applies to, five-tuple information about the flow (source/destination IP address, source/destination port, and protocol), and if the traffic was allowed or denied.
  5. MicroNoob 👍 3 Answered B
    I am also leaning towards the correct answer being IP Flow Verify based on the description that it focuses on the packet access to VMs. The question appears to be concerned with the VMs which would make this a more appropriate answer.
Show 25 more comments
  1. Bigio 👍 3 Answered B
    "IP flow verify checks if a packet is allowed or denied to or from a virtual machine." https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview
  2. stonwall12 👍 2
    Correct Answer - B: No, Azure Traffic Analytics (CORRECT ANSWER IS IP FLOW VERIFY) Azure Traffic Analytics provides insights into the network traffic through Azure resources. It can help you understand traffic flow patterns, identify security and networking issues, and optimize your network deployments. To analyze the network traffic in the described scenario, tools like Azure Network Watcher, specifically its IP flow verify feature, would be more appropriate. https://learn.microsoft.com/en-us/rest/api/network-watcher/network-watchers/verify-ip-flow?tabs=HTTP
  3. ExStudent 👍 2
    Correct answer - B (Based on the IP Flow docs IP flow verify in Azure Network Watcher IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.
  4. Greysi 👍 2 Answered A
    Correct answer is A - YES from my point of view. https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics "Pinpoint network misconfigurations leading to failed connections in your network" "Statistics of blocked traffic. Why a host is allowing or blocking significant traffic volume" ... All these information can help to find root cause of connectivity issue.
  5. Gamos 👍 2 Answered A
    Based on the documentation in this link https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics, with network traffic analyzer you can: - Pinpoint network misconfigurations that can lead to failed connections in your network. And it provides the following information: - Allowed and blocked traffic So for me correct answer is A
  6. memo454 👍 2
    B. IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow - latency and network issues at the VM LEVEL.
  7. flash007 👍 2
    no ip flow verify is used to check if anything is blocked regarding traffic
  8. aleksandarivanov 👍 2
    i don't see an NSG mentioned in the question, tho
  9. uffman 👍 2 Answered B
    Correct answer is given.
  10. Rick365 👍 2 Answered B
    Vote B
  11. Chenn 👍 1
    A. Yes Azure Traffic Analytics, a feature of Azure Network Watcher, provides comprehensive visibility into network traffic across your Azure deployments. It can analyze network traffic to and from your Azure resources, helping you identify whether packets are being allowed or denied to your virtual machines. Therefore, using Azure Traffic Analytics in Azure Network Watcher would meet the goal of analyzing network traffic to identify connectivity issues with the virtual machines. Please note that this recommendation is based on the information provided and might need to be adjusted based on further specifics of your environment and requirements. Always test configurations in a controlled environment before deploying them in production.
  12. sirine19870 👍 1 Answered A
    Azure Network Watcher is a tool designed to monitor and diagnose network issues in Azure. Traffic Analytics is a feature within Network Watcher that uses NSG flow logs to: Identify allowed or denied connections Visualize inbound and outbound traffic flows Detect anomalies or network connectivity issues It helps identify problems related to: Misconfigured NSG (Network Security Group) rules Incorrect traffic filtering Improper segmentation
  13. AlfKay 👍 1 Answered A
    I dont convince it is A but from this,it seems Traffic Analytics can do the work to determine block and allowed packets, https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-usage-scenarios. Look for, "Statistics of blocked traffic. Why is a host blocking a significant volume of benign traffic? This behavior requires further investigation and probably optimization of configuration"
  14. PM_PM 👍 1 Answered A
    Azure Traffic Analytics is a feature of Azure Network Watcher that allows you to monitor and analyze network traffic to identify connectivity issues. By using Azure Traffic Analytics, you can gain insight into the network traffic and identify whether packets are being allowed or denied to the virtual machines.
  15. Turnkey 👍 1 Answered A
    The question asks whether Traffic Analytics can identify traffic being allowed or denied. Microsoft explicitly lists “Allowed and blocked traffic” and “Most-blocking rules” among its capabilities. It analyzes flow logs that record whether traffic was allowed or denied
  16. Satan4u 👍 1 Answered A
    You can use Azure Traffic Analytic to check "The status of the traffic, such as allowed or denied." based on this doc: https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?utm_source=chatgpt.com&tabs=Americas
  17. ahorva 👍 1
    Not really sure about this - one of the Traffic Analytics use cases: - Pinpoint network misconfigurations leading to failed connections in your network https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics
  18. 6beee3e 👍 1 Answered B
    If the goal is “analyze traffic patterns (allowed/denied)” → Traffic Analytics works If the goal is “verify whether a specific packet is allowed or denied to a VM” → Not sufficient
  19. tvdtharindu 👍 1 Answered A
    The correct answer is A: Reference: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview#ip-flow-verify
  20. bigpeepee 👍 1
    I hear you but the from what I can gather from the question is that vms and a network existed previously and now its expressroute
  21. bigpeepee 👍 1
    but nsg blocks packets or not? It does and it has me second guess it as b is an allowable answer.
  22. Gor 👍 1 Answered B
    IP Flow Verify in Network Watcher gives you option to verify if traffic is allowed or denied.
  23. PeterHu 👍 1
    this is on VM level ,not on NSG ,so the answer is B
  24. OPT_001122 👍 1 Answered B
    No Correct ans - Azure Network Watcher IP Flow
  25. bigpeepee 👍 1
    I will put my final answer as A.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which components handle AKS state, pub/sub, and traffic splitting?

S-Grade

Which Azure Storage setup retains blobs immutably for five years?

S-Grade

Which Azure Monitor Features Provide Synthetic Transaction Monitoring for App1?

S-Grade

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide