Exam AZ-104 topic 5 question 73 discussion

If you initiated a packet capture from VM1 to VM2 and ran a capture for three hours, wouldn't you have file which contained all traffic between VM1 and VM2?

There are several versions of this question. The following are the possible Correct and Incorrect solutions. Correct solution: Meets the goal. -Solution: From Azure Network Watcher, you create a packet capture. Incorrect solution: Does not meet the goal. -Solution: From Azure Monitor, you create a metric on Network In and Network Out. -Solution: From Azure Network Watcher, you create a connection monitor. -Solution: From Performance Monitor, you create a Data Collector Set (DCS).

Packet Capture: Allows you to remotely capture network traffic to and from a VM or VMSS. You can configure filters based on IP addresses, ports, and protocols, set size limits, and specify storage for the captured data. This is invaluable for deep packet analysis and troubleshooting complex network problems

Yes is right

- Connection troubleshoot enables a one-time connectivity and latency check between a virtual machine and Bastion host, application gateway, or another virtual machine. - Packet capture enables you to capture your virtual machine traffic. Yes - https://learn.microsoft.com/en-us/azure/network-watcher/frequently-asked-questions

A. Yes Creating a packet capture using Azure Network Watcher is a valid solution to inspect network traffic between VM1 and VM2. Network Watcher provides network monitoring and diagnostic capabilities in Azure, including the ability to capture packets flowing between resources within a virtual network.

A is the answer. https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview Network Watcher variable packet capture allows you to create packet capture sessions to track traffic to and from a virtual machine. Packet capture helps to diagnose network anomalies both reactively and proactively. Other uses include gathering network statistics, gaining information on network intrusions, to debug client-server communications and much more.

it specifically says from VM1 to VM2. Nature of packet capture is to run the capture in a VM/machine, it does not matter where the traffic is sent to. You use filter if you want to see certain packets including where it goes, type of traffic etc etc. Yes you can use this tool for VM to VM but it is not the best tool to use it. For the purpose, I'd got with Connection Monitor.

Answer is YES

Answer is yes. This is a copy and paste straight from exam-104 text book: The Packet Capture tool allows you to capture network packets entering or leaving your virtual machines. It is a powerful tool for deep network diagnostics. You can capture all packets, or a filtered subset based on the protocol and local and remote IP addresses and ports. You can also specify the maximum packet and overall capture size, and a time limit (captures start almost immediately once configured). Packet captures are stored as a file on the VM or in an Azure storage account, in which case NSGs must allow access from the VM to Azure storage. These captures are in a standard format and can be analyzed off-line using common tools such as WireShark or Microsoft Message Analyzer. **Also, if you go into Network Watcher, you will see under diagnostic tools - Packet Capture.

I will go A

Answer B - No • **Packet Capture**: Is run on a VM to monitor the in and out flows of IP traffic. It is not used to monitor traffic BETWEEN two VMs. MS Docs: ("Packet Capture enables you to capture all traffic on a VM in your virtual network.") • **Connection Monitor**: Is used to monitor connectivity and latency between VMs over a period of time. MS Docs: ("Connection Monitor allows you to monitor connectivity and latency between a VM and another network resource.") Read Here: https://docs.microsoft.com/en-us/azure/network-watcher/frequently-asked-questions#what-tools-does-network-watcher-provide-

Connection monitor doesn't capture packets, Network Watcher does therefore A is correct

Should be A: Azure Network Watcher provides tools to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. Capture packets to and from a VM Advanced filtering options and fine-tuned controls, such as the ability to set time and size limitations, provide versatility. The capture can be stored in Azure Storage, on the VM's disk, or both. You can then analyze the capture file using several standard network capture analysis tools. Network Watcher variable packet capture allows you to create packet capture sessions to track traffic to and from a virtual machine. Packet capture helps to diagnose network anomalies both reactively and proactivity. References: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

Packet capture is correct similar to wireshark, it allows for Sources/Des IP, Ports and times allocation and can be triggered automatically via VMs alert

It should be the packet capture as we've got in the configuration 'Time limit' field - the duration of the capture session to the file. Connection monitor has got the 'Test frequency' setting - how frequently sources will ping destinations, we're not collecting the traffic for the future inspection. The idea in the Connection monitor is to pass a test.

Packet capture can be set to specified interval and connection monitor is for end-to-end monitoring specific connections. Here you have to capture all network traffic.