Pass the Microsoft Microsoft Certified: Azure Network Engineer Associate AZ-700 Questions and answers with CertsForce

Here are the steps and explanations for configuring VNET1 to log all events and metrics and query them by using KQL:

To enable logging for VNET1, you need to create a diagnostic setting that collects the platform metrics and logs from the virtual network and routes them to one or more destinations.  You can choose to send the data to a Log Analytics workspace, a storage account, an event hub, or a partner solution 1 .

To create a diagnostic setting, you need to go to the Azure portal and select your virtual network.  Then select Diagnostic settings under Monitoring and select + Add diagnostic s etting 1 .

On the Add diagnostic setting page, enter or select the following information:

Diagnostic setting name: Type a unique name for your diagnostic setting.

Destination details: Select the destination where you want to send the data. For example, you can select Send to Log Analytics workspace and choose your workspace from the list.

Log: Select the categories of logs that you want to collect.  For VNET1, you can select NetworkSecurityGro up Event and NetworkSecurityGroupRuleCounter as the log categories 2 .

Metric: Select AllMetrics to collect all the platform m etrics for VNET1 2 .

Select Save to create your diagnostic se tting 1 .

To query the events and metrics from the Azure portal by using KQL, you need to go to the Log Analytics workspace that you selected as the destination.  Then select Logs under Gener al and enter your KQ L query in the query editor 3 .

For example, you can use the following KQL query to get the top 10 network security group events for VNET1 in the last 24 hours:

NetworkSecurityGr oupEvent

| where TimeGenerated > ago(24h)

| where ResourceId contains " VNET1 "

| summarize count() by EventID

| top 10 by count_

Copy

Select Run to execute your query and view the re sults in a tabl e or a chart 3 .

NO, NO, YES

1. VM3 can connect to port 8080 on VM1 : false, UserRule_DenyVirtualNetworkInbound

2. VM1 and VM2 can connect on port 9090: false, UserRule_DenyVirtualNetworkInbound

3. VM1 can connect to VM3 on port 9090: true

To deploy a firewall to subnetl-2, you need to create a network virtual appliance (NVA) in the same virtual network as subnetl-2.  An NVA is a virtual machine that performs network functions, such as firewall, routing, or load balanc ing 1 .

To create an NVA, you need to create a virtual machine in the Azure portal and select an image that has the firewall software installed.  You can choose from th e Azure Marketplace or upload your own image 2 .

To assign the IP address of 10.1.2.4 to the NVA, you need to create a static private IP address for the network interface of the virtual machine.  You can do this in the IP configura tions settings of the network interface 3 .

To ensure that traffic from subnetl-1 to the IP address range of 192.1 68.10.0/24 is routed through the NVA, you need to create a user-defined route (UDR) table and associate it with subnetl-1.  A UDR table allows you to override the default routing behavior of Azure and specify custom routes for your subnets 4 .

To create a UDR ta ble, you need to go to the Route tables service in the Azure portal and select + Create.  You can give a name and a resource group for the route table 5 .

To create a custom route, you need to select Routes in the route table and select + Add.  You can enter the f ollowing information for the route 5 :

Destination: 192.168.10.0/24

Next hop type: Virtual appliance

Next hop address: 10.1.2.4

To associate the route table with subnetl-1, you need to select Subnets in the route table and select + Associate.  Y ou can select the virtual network and subnet that you want to asso ciate with the route table 5 .