AZ-104 Implement and Manage Virtual Networking Practice Question
You manage an Azure virtual network with multiple subnets, including a subnet named 'AppSubnet' that hosts critical application servers. You need to monitor and log network traffic to and from AppSubnet for security analysis. The solution must capture all flow logs without impacting application performance. Which three of the following should you implement? (Choose three.)
⚠ Common exam trap
A common mix-up: candidates confuse VM-level diagnostic settings (which log guest OS metrics) with subnet-level flow logs, or they mistakenly believe that deploying an NVA is required for traffic monitoring, when in fact Azure's native Network Watcher flow logs provide a performance-neutral solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Network Watcher flow logs for AppSubnet.
Network Watcher flow logs capture IP traffic flowing through a subnet, providing security analysis without impacting performance because they are processed by the Azure network fabric, not by the VMs. Storing logs in an Azure Storage account ensures durable, cost-effective retention. Configuring a retention policy is essential to manage storage costs and comply with data lifecycle requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Network Watcher flow logs for AppSubnet.
Why this is correct
Network Watcher flow logs capture metadata about IP traffic that traverses an NSG, such as source/destination IP and port, protocol, and the allow/deny disposition after NSG rules are evaluated. For AppSubnet, this means enabling NSG flow logs on every NSG applied to that subnet's network interfaces. This is the native Azure mechanism for auditing network traffic on a subnet without deploying agents or inline appliances.
- ✗
Deploy a network virtual appliance (NVA) in a transit subnet and route all traffic through it.
Why it's wrong here
Deploying an NVA in a transit subnet and using user-defined routes to force all traffic through it is an architectural change that filters or inspects traffic, but it does not by itself persist flow logs; the NVA would need separate packet capture or telemetry configuration. It also adds a routing dependency and can become a bottleneck, so it is overkill and not the required Azure-native logging action. This approach is appropriate for policy enforcement, not for meeting a subnet-level traffic logging requirement.
- ✓
Store the flow logs in an Azure Storage account.
Why this is correct
NSG flow logs are not stored in Network Watcher itself; you must designate a destination such as an Azure Storage account to persist the raw JSON flow log files, which can later be downloaded or exported into Log Analytics for querying. An Azure Storage account is a cost-effective destination that supports retention and is required for the raw flow log records to remain available after the flow is captured. You can optionally stream to Log Analytics, but a storage account is the standard persistence target.
- ✗
Enable diagnostic settings on each virtual machine in AppSubnet to log network traffic.
Why it's wrong here
Virtual machine diagnostic settings transmit VM-level metrics, boot logs, and guest OS logs to Log Analytics or storage; they do not capture the network packets or flow metadata passing through the NSG boundaries. Enabling diagnostic settings on each VM in AppSubnet would require connecting every instance and still would not show flows denied before they reach the VM or traffic between VMs. Network-level flow logging can't be approximated by VM-level diagnostics because the NSG is evaluated outside the guest OS.
- ✓
Configure a retention policy for the flow logs to manage storage costs.
Why this is correct
Flow log data accumulates quickly because one JSON file is produced hourly per NSG, so an unmanaged storage container can grow without bound and inflate Azure costs. Configuring a retention policy on the flow log resource tells Azure to purge logs older than the specified number of days, which directly limits storage consumption. If you set retention to zero, the logs are kept indefinitely, so a non-zero retention period is essential for predictable cost management.
- ✗
Install a third-party packet capture agent on each application server.
Why it's wrong here
A third-party packet capture agent installed on each application server only sees traffic that actually reaches the guest OS, so it cannot report flows dropped by NSG security rules or inbound traffic never delivered. It also introduces per-VM licensing, CPU/memory overhead, and an operational burden to install and update agents across the fleet. This is not a native Azure diagnostic method and is unnecessary when NSG flow logging already provides subnet-level traffic metadata.
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Network Watcher
Network Watcher is a monitoring and diagnostics service used in cloud environments to track network traffic, detect issues, and analyze performance between virtual machines and other resources.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.