Exam AZ-720 topic 2 question 20 discussion

Actual exam question from Microsoft's AZ-720

Question #: 20
Topic #: 2

A company has two virtual networks (VNets) that are configured to use peering. Several Azure virtual machines are connected to each network. An on-premises network is connected to one of the VNets by using Azure VPN Gateway.
An administrator reports that communication between applications across the VNets is failing.
You need to troubleshoot the issue.
Which two features can you use to achieve the goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. IP flow verify
B. Next hop
C. AzureNetworkWatchExtension
D. Network Watcher topology
E. NSG flow logs

Show Suggested Answer

Suggested Answer: AB 🗳️

by cris_exam at April 23, 2023, 3:49 p.m.

Comments

Submit Cancel

Neostar

1 year, 11 months ago

Selected Answer: AB

IP flow verify and Next hop to check security rules and routing.

upvoted 1 times

...

Hulla_Dussa

2 years, 1 month ago

This should be 'AB'

upvoted 1 times

...

Gaazr

2 years, 1 month ago

AC https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-troubleshoot-peering-issues#troubleshoot-a-connectivity-issue-between-two-peered-virtual-networks Use "Connection Troubleshoot" (C) and "IP flow verify" (A) from the source VM to the destination VM to determine whether there is an NSG or UDR that is causing interference in traffic flows. https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-connectivity-overview "The connection troubleshoot feature of Azure Network Watcher" (C)

upvoted 1 times

Neostar

1 year, 11 months ago

C is AzureNetworkWatchExtension which is the VM extension used by some Network Watcher features. Connection troubleshoot is not among the available answers!

upvoted 1 times

...

cris_exam

2 years, 2 months ago

Selected Answer: AE

I going with AE here. I would have considered looking into the Next Hop effective routes if the faulty communication would have been between Azure and onprem but since it's between 2 peered VNETs, the default routing takes precedence anyway - unless we have UDRs but that is not mentioned. Checking packet behavior with IP Flow and traffic access logs from NSG flow logs would be the best approach here imho.

upvoted 1 times

Neostar

1 year, 11 months ago

The questions mentions failing communication, it's much easier to start with IP flow verify and Next hop to check security rules and routing.

upvoted 1 times

...