Azure Network Watcher Packet Capture Storage Locations

AZ-700 By islever Editorial Last updated

Monitor networks

Short answer

D Save captured network traffic to a General purpose v2 standard storage account or a local file path on VM1.

Question

You have an Azure virtual machine named VM1. You need to capture all the network traffic of VM1 by using Azure Network Watcher. To which locations can the capture be written?
  1. a file path on VM1 only
  2. General purpose v2 standard only
  3. a Block blob premium account only
  4. General purpose v2 standard and a file path on VM1 only Correct Answer
  5. General purpose v2 standard and a Block blob premium account only

Key Takeaways

Tests knowledge of Azure Network Watcher capture output options, with the common trap being confusion between supported standard storage tiers and unsupported premium tiers or direct local-only saves.

Determines valid storage destinations for Azure Network Watcher packet captures, confirming support for General Purpose v2 standard accounts and local file paths on the target VM.

Common mistake: Learners often incorrectly select Block blob premium accounts due to their high-performance nature, not realizing they are currently unsupported for this specific feature.

Expert Analysis

Why the Answer Is Correct

Azure Network Watcher packet captures can be saved to two primary locations: a local file path on the virtual machine itself (e.g., /var/captures for Linux) and an Azure Storage account. Specifically, the supported storage account type is General Purpose v2 (standard). This allows administrators to retain captures in cloud storage for long-term analysis while also having immediate access via the local disk.

Why the Other Options Are Wrong

Option A is incorrect because it excludes storage accounts, which are a key feature. Option C is wrong because Block blob premium accounts are not supported for packet capture storage. Options B and E are incorrect as they either exclude the local file path option or include the unsupported premium tier. The combination of General Purpose v2 standard and local file path (Option D) covers all valid current capabilities.

Community Comment Notes

The community consensus strongly favors Option D. As user 'manhattan' noted, "Premium storage accounts are currently not supported... it's D the correct one," referencing official Microsoft documentation. Another commenter clarified that users can choose to save data in the local disk or in Azure storage blob, specifically selecting Standard storage accounts.

Official Reference

https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-vm-portal

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the specific Azure Storage account types supported by Azure Monitor features; often, 'General Purpose v2' is the safe default for newer features, while older or specialized tiers may have restrictions.

Frequently Asked Questions

Can I save Azure Network Watcher captures to Premium Storage?

No, only General Purpose v2 standard storage accounts are supported for storing packet capture files.

Where do packet captures go if I don't specify a storage account?

If you select the local file path option, captures are saved directly to the VM's disk (e.g., /var/captures on Linux).

More AZ-700 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. manhattan 👍 4 Answered D
    E is wrong, Premium storage accounts are currently not supported for storing packet captures it's D the correct one, look here: https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-vm-portal You can choose to save captured data in the local disk or in Azure storage blob. https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-overview
  2. rilanc24 👍 2 Answered D
    Capture location Select Storage account, File, or Both. Storage account Select your Standard storage account1. This option is available if you selected Storage account or Both as a capture location. Local file path Enter a valid local file path where you want the capture to be saved in the target virtual machine. If you're using a Linux machine, the path must start with /var/captures. This option is available if you selected File or Both as a capture location.
  3. nkhan1357 👍 1 Answered E
    When using Azure Network Watcher to capture network traffic from a VM, you can choose to save the capture file to either a general purpose v2 standard storage account or a block blob premium storage account. You cannot directly save the capture to a file path on the VM itself.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Private Endpoint UDR Routing Prerequisite

S-grade

Minimum Azure Service Endpoints for Peered VNets

S-grade

Logging Application of Specific NSG Rules

S-grade

Azure DNS Private Resolver Minimum Deployment

S-grade

Practice All AZ-700 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-700 Practice Test →

← Back to AZ-700 Study Guide