Exam AZ-700 topic 4 question 56 discussion

NSG flow logs capture each unique flow, which is defined by the combination of the following: - Source IP - Source port - Destination IP - Destination port - Protocol The answer is 5

Flows that have the same Source IP, Destination IP, Destination port, NSG name, NSG rule, Flow Direction, and Transport layer protocol (TCP or UDP) are clubbed into a single flow by traffic analytics (Note: source port is excluded for aggregation).

Is source port not excluded from aggregation? According to https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-schema?tabs=nsg#data-aggregation Hence only 2 aggregations.

How traffic analytics works Traffic analytics examines raw flow logs. It then reduces the log volume by aggregating flows that have a common source IP address, destination IP address, destination port, and protocol. An example might involve Host 1 at IP address 10.10.10.10 and Host 2 at IP address 10.10.20.10. Suppose these two hosts communicate 100 times over a period of one hour. The raw flow log has 100 entries in this case. If these hosts use the HTTP protocol on port 80 for each of those 100 interactions, the reduced log has one entry. That entry states that Host 1 and Host 2 communicated 100 times over a period of one hour by using the HTTP protocol on port 80.

Based on the information provided in the image and the analysis of the NSG flow logs, Traffic Analytics in Azure Network Watcher will identify 5 aggregated flow entries. To break this down: RDP Sessions: Two RDP sessions from VM1 to VM2 Each initiated from a different TCP port Total RDP flow entries: 2 SSH Sessions: Three SSH sessions from VM2 to VM1 Each initiated from a different TCP port Total SSH flow entries: 3 The total number of aggregated flow entries is the sum of RDP and SSH sessions: 2 + 3 = 5.