AZ-500 Secure networking Practice Question
A security administrator is troubleshooting network connectivity to an Azure virtual machine. The VM is behind a network security group (NSG) that has a deny-all inbound rule as the default. The administrator wants to quickly verify whether a specific TCP packet on port 3389 from their client IP (203.0.113.50) would be allowed or blocked by the NSG. Which Azure Network Watcher tool should they use?
⚠ Common exam trap
Many candidates confuse NSG flow logs (which provide historical traffic data) with the real-time diagnostic capability of IP flow verify, leading them to select NSG diagnostics (flow logs) instead of the correct tool for on-demand packet testing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP flow verify.
IP flow verify is the correct tool because it tests whether a specific packet (source IP, destination IP, protocol, port) is allowed or denied by an NSG or virtual network (VNet) route. In this scenario, the administrator needs to quickly validate inbound TCP traffic on port 3389 from client IP 203.0.113.50 to the VM, and IP flow verify provides a pass/fail result along with the exact rule that caused the outcome.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network Performance Monitor.
Why it's wrong here
Network Performance Monitor (NPM) is an Azure Monitor-based solution that measures network latency, packet loss, and topology across virtual machines, ExpressRoute, and VPN connections. It relies on agents installed on monitored endpoints to gather performance telemetry and cannot simulate a specific packet against a network security group (NSG). Therefore, while NPM helps identify degraded or failing network paths, it is not designed to validate whether a particular NSG rule permits or denies a given traffic flow, making it incorrect for this troubleshooting scenario.
- ✓
IP flow verify.
Why this is correct
IP flow verify, part of Azure Network Watcher, takes a specified protocol, source IP/port, destination IP/port, and the target virtual machine’s network interface to simulate an actual packet. The tool then evaluates the effective security rules applied at both the subnet and network interface levels and returns an allow or deny decision along with the exact rule that allowed or blocked the traffic. This makes it the correct choice for validating NSG rules because it directly answers whether a specific packet is permitted in real time.
- ✗
Next hop.
Why it's wrong here
The Next hop capability in Network Watcher identifies the next hop type and IP address for a packet based on the effective route table associated with a VM—for example, Internet, VirtualNetworkGateway, or a virtual appliance—but it does not inspect NSG rules. A route may correctly point to a valid next hop, yet an NSG rule can still block the traffic before it leaves the VM. Consequently, Next hop is designed for diagnosing routing issues and cannot validate the allow/deny decisions made by network security groups.
- ✗
NSG diagnostics (flow logs).
Why it's wrong here
NSG diagnostics (flow logs) continuously capture information about IP traffic flowing through an NSG, recording allow/deny outcomes, source/destination addresses, ports, and packet counts into a storage account or Log Analytics workspace for historical analysis. These logs are not interactive: they do not let you simulate an arbitrary test packet on demand and are instead analyzed after the fact using queries or network monitoring tools. Because flow logs require enabling diagnostics and waiting for data to accumulate, they are unsuitable for immediate, packet-specific NSG rule validation, unlike IP flow verify.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.