Exam AZ-104 topic 2 question 33 discussion

Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

correct answer

To enable Traffic Analytics, Admin1 needs permissions to manage Network Watcher and Log Analytics, which are required for Traffic Analytics. The Network Contributor role grants permissions to manage network resources (e.g., virtual networks, load balancers, network security groups) but does not provide access to Log Analytics workspaces, which are necessary for Traffic Analytics.

To use Traffic analytics, you must assign one of the following Azure built-in roles to your account: Deployment model Role Resource Manager Owner Contributor Network contributor 1 and Monitoring contributor 1 Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions. If none of the preceding built-in roles are assigned to your account, assign a custom role that supports the actions listed in Flow logs and Traffic analytics permissions. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas

You need monitor contributor and network contributor.

No, this does not meet the goal. The Network Contributor role allows managing network resources (such as virtual networks, network interfaces, and network security groups), but it does not provide the required permissions to enable Traffic Analytics. To enable Traffic Analytics, the user must have the Reader or Contributor role at the subscription level to access traffic data and must also have the Log Analytics Contributor role on the Log Analytics workspace where the traffic analytics data is stored. Correct Solution: Assign the Log Analytics Contributor role to Admin1 on the Log Analytics workspace used for Traffic Analytics.

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas#prerequisites Tested in Lab, you need "Network contributor" and "Monitoring contributor"

Network contributor and Monitoring contributor * Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas#prerequisites

assigning the Network Contributor role to the user at the appropriate level (e.g., subscription or resource group) will provide sufficient permissions to enable and configure Traffic Analytics.

Answer from ChatGPT : Why "Network Contributor" is Insufficient? While the Network Contributor role allows managing NSGs, it does not include permissions to enable diagnostics or configure Log Analytics settings. By assigning the Contributor role or combining the above permissions in a custom role, you can accomplish this task. Let me know if you need further clarification or examples!

A is correct as per recent Microsoft documentation https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites

Monitoring contributor role is also required, along with Network Contributor https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#key-components

Network Watcher can be applied in various scenarios to ensure network integrity and performance: Enabling Traffic Analytics: Assigning roles such as Owner, Contributor, or Network Contributor at the subscription level to enable traffic analytics. A is indeed correct!

ChatGPT B. No Assigning the Network Contributor role to Admin1 at the subscription level does not meet the goal of enabling Traffic Analytics for the Azure subscription. The Network Contributor role provides permissions to manage network resources, such as virtual networks and network interfaces, but it does not grant the necessary permissions to enable Traffic Analytics. To enable Traffic Analytics for an Azure subscription, you need to assign the Log Analytics Contributor or the Network Watcher Contributor role to Admin1 at the subscription level. These roles provide the necessary permissions to configure and enable Traffic Analytics.

Answer A es, this meets the goal. The Network Contributor role at the subscription level allows users to manage network resources, including enabling Traffic Analytics. Here are the steps on how to assign the Network Contributor role to Admin1: Go to the Azure portal. In the left navigation pane, select Roles and subscriptions. In the Subscriptions tab, select the subscription that you want to assign the role to. In the Roles tab, select Add role assignment. In the Select a role dialog box, select Network Contributor. In the Select users or groups dialog box, enter the name of the user or group that you want to assign the role to. Select the Select button. In the Review + assign dialog box, review the role assignment, and then select the Assign button. Once you have assigned the Network Contributor role to Admin1, they will be able to enable Traffic Analytics for the Azure subscription.

A is correct

A is the correct answer