Exam AZ-104 topic 2 question 33 discussion

Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

correct answer

To successfully enable and configure Traffic Analytics, the user (e.g., Admin1) typically needs the following roles: 1. Network Contributor 2. Log Analytics Contributor.

B is correct answer

Correct Answer: B. No Explanation: To enable Traffic Analytics, a user must have read access to NSG flow logs (stored in a storage account), and permissions to configure Network Watcher, Log Analytics workspace, and Traffic Analytics settings. The Network Contributor role does not grant access to the Log Analytics workspace, which is required to enable and configure Traffic Analytics. Why not A. Yes? Because Network Contributor alone cannot configure or write to Log Analytics workspaces, which is a required step in enabling Traffic Analytics.

To enable Traffic Analytics, you need permissions for: Network Watcher and NSG Flow Logs "Microsoft.Network/networkWatchers/*" "Microsoft.Network/networkSecurityGroups/*" Diagnostic settings (to send data to Log Analytics) "Microsoft.Insights/diagnosticSettings/*" Log Analytics workspace access "Microsoft.OperationalInsights/workspaces/*"

Correct answer is A

No, assigning the Network Contributor role at the subscription level to Admin1 does not meet the goal of enabling Traffic Analytics. Why? Traffic Analytics requires permissions to: Read Azure network data (e.g., NSG flow logs). Write to a Log Analytics workspace (to store and analyze traffic data). The Network Contributor role only grants permissions to manage Azure networking resources (e.g., VNets, NSGs) but does not include: Access to Log Analytics workspaces. Required permissions for Traffic Analytics (e.g., Microsoft.OperationalInsights/workspaces/*).

To enable Traffic Analytics, Admin1 needs permissions to manage Network Watcher and Log Analytics, which are required for Traffic Analytics. The Network Contributor role grants permissions to manage network resources (e.g., virtual networks, load balancers, network security groups) but does not provide access to Log Analytics workspaces, which are necessary for Traffic Analytics.

To use Traffic analytics, you must assign one of the following Azure built-in roles to your account: Deployment model Role Resource Manager Owner Contributor Network contributor 1 and Monitoring contributor 1 Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions. If none of the preceding built-in roles are assigned to your account, assign a custom role that supports the actions listed in Flow logs and Traffic analytics permissions. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas

You need monitor contributor and network contributor.

No, this does not meet the goal. The Network Contributor role allows managing network resources (such as virtual networks, network interfaces, and network security groups), but it does not provide the required permissions to enable Traffic Analytics. To enable Traffic Analytics, the user must have the Reader or Contributor role at the subscription level to access traffic data and must also have the Log Analytics Contributor role on the Log Analytics workspace where the traffic analytics data is stored. Correct Solution: Assign the Log Analytics Contributor role to Admin1 on the Log Analytics workspace used for Traffic Analytics.

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas#prerequisites Tested in Lab, you need "Network contributor" and "Monitoring contributor"

Network contributor and Monitoring contributor * Network contributor doesn't cover Microsoft.OperationalInsights/workspaces/* actions. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas#prerequisites

assigning the Network Contributor role to the user at the appropriate level (e.g., subscription or resource group) will provide sufficient permissions to enable and configure Traffic Analytics.

Answer from ChatGPT : Why "Network Contributor" is Insufficient? While the Network Contributor role allows managing NSGs, it does not include permissions to enable diagnostics or configure Log Analytics settings. By assigning the Contributor role or combining the above permissions in a custom role, you can accomplish this task. Let me know if you need further clarification or examples!

A is correct as per recent Microsoft documentation https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites