Next-hop checks identify the Azure routing decision toward a destination. In this case, two NSGs are attached and an operator cannot identify which blocks RDP. “Network Watcher next hop or effective route inspection” would not satisfy that requirement; the supported action is “Inspect effective security rules or IP flow verification”. Effective rules reveal combined subnet and NIC filtering decisions.

Effective routing can direct traffic via configured appliances. In this case, two NSGs are attached and an operator cannot identify which blocks RDP. “A user-defined route may supersede the expected peering route” would not satisfy that requirement; the supported action is “Inspect effective security rules or IP flow verification”. Effective rules reveal combined subnet and NIC filtering decisions.

Protocol-specific probing reveals failures that ICMP alone cannot show. In this case, two NSGs are attached and an operator cannot identify which blocks RDP. “Connection Monitor testing the specific TCP endpoint and port” would not satisfy that requirement; the supported action is “Inspect effective security rules or IP flow verification”. Effective rules reveal combined subnet and NIC filtering decisions.

Storage soft-delete data has no authoritative information about current virtual network resources or peering. The competing choice “Use a storage account soft-delete report to infer network links” does not meet the specific requirement: An engineer wants a visual inventory of Azure virtual network and related connected resources to investigate an unexpected peering layout. Which Network Watcher capability provides a topology view. The supported action is “Use Network Watcher topology to visualize supported resources and relationships within the selected scope”.

Cost optimization recommendations cannot substitute for a network topology view. The competing choice “Inspect Azure Advisor cost recommendations instead of the network layout” does not meet the specific requirement: An engineer wants a visual inventory of Azure virtual network and related connected resources to investigate an unexpected peering layout. Which Network Watcher capability provides a topology view. The supported action is “Use Network Watcher topology to visualize supported resources and relationships within the selected scope”.

Giving every VM a public IP does not document the network relationships and would add an unnecessary management exposure. The competing choice “Create a public IP on every virtual machine as a substitute for examining network topology” does not meet the specific requirement: An engineer wants a visual inventory of Azure virtual network and related connected resources to investigate an unexpected peering layout. Which Network Watcher capability provides a topology view. The supported action is “Use Network Watcher topology to visualize supported resources and relationships within the selected scope”.

Packet-level evidence complements aggregate connectivity metrics. In this case, an admin sees an active VNet peering but packets reach a virtual appliance instead. “A bounded packet capture during the incident window” would not satisfy that requirement; the supported action is “A user-defined route may supersede the expected peering route”. Effective routing can direct traffic via configured appliances.

Packet capture records network traffic for detailed protocol troubleshooting. In this case, an admin sees an active VNet peering but packets reach a virtual appliance instead. “Network Watcher packet capture on supported virtual machines” would not satisfy that requirement; the supported action is “A user-defined route may supersede the expected peering route”. Effective routing can direct traffic via configured appliances.

Effective rules reveal combined subnet and NIC filtering decisions. In this case, an admin sees an active VNet peering but packets reach a virtual appliance instead. “Inspect effective security rules or IP flow verification” would not satisfy that requirement; the supported action is “A user-defined route may supersede the expected peering route”. Effective routing can direct traffic via configured appliances.

Next-hop checks identify the Azure routing decision toward a destination. In this case, a network team needs to capture traffic for diagnosing intermittent TCP retransmissions. “Network Watcher next hop or effective route inspection” would not satisfy that requirement; the supported action is “Network Watcher packet capture on supported virtual machines”. Packet capture records network traffic for detailed protocol troubleshooting.

Effective routing can direct traffic via configured appliances. In this case, a network team needs to capture traffic for diagnosing intermittent TCP retransmissions. “A user-defined route may supersede the expected peering route” would not satisfy that requirement; the supported action is “Network Watcher packet capture on supported virtual machines”. Packet capture records network traffic for detailed protocol troubleshooting.

KQL has multiple comparison operators with different case behavior. In this case, a network team needs to capture traffic for diagnosing intermittent TCP retransmissions. “Use appropriate KQL string comparison semantics and normalized identifiers” would not satisfy that requirement; the supported action is “Network Watcher packet capture on supported virtual machines”. Packet capture records network traffic for detailed protocol troubleshooting.

Effective routing can direct traffic via configured appliances. In this case, a latency chart identifies a problem but not malformed packets. “A user-defined route may supersede the expected peering route” would not satisfy that requirement; the supported action is “A bounded packet capture during the incident window”. Packet-level evidence complements aggregate connectivity metrics.

KQL has multiple comparison operators with different case behavior. In this case, a latency chart identifies a problem but not malformed packets. “Use appropriate KQL string comparison semantics and normalized identifiers” would not satisfy that requirement; the supported action is “A bounded packet capture during the incident window”. Packet-level evidence complements aggregate connectivity metrics.

Selective predicates isolate relevant records from the workspace tables. In this case, a latency chart identifies a problem but not malformed packets. “Use where on the resource identifier and severity or error fields” would not satisfy that requirement; the supported action is “A bounded packet capture during the incident window”. Packet-level evidence complements aggregate connectivity metrics.

KQL supports aggregation and top-N filtering across log records. In this case, an admin wants a Log Analytics query to find all errors for a resource ID. “Summarize counts by type, sort descending and take five” would not satisfy that requirement; the supported action is “Use where on the resource identifier and severity or error fields”. Selective predicates isolate relevant records from the workspace tables.

Ranked summaries require grouping rather than raw event display. In this case, an admin wants a Log Analytics query to find all errors for a resource ID. “Aggregate counts by a chosen dimension before sorting” would not satisfy that requirement; the supported action is “Use where on the resource identifier and severity or error fields”. Selective predicates isolate relevant records from the workspace tables.

Packet-level evidence complements aggregate connectivity metrics. In this case, an admin wants a Log Analytics query to find all errors for a resource ID. “A bounded packet capture during the incident window” would not satisfy that requirement; the supported action is “Use where on the resource identifier and severity or error fields”. Selective predicates isolate relevant records from the workspace tables.

KQL supports aggregation and top-N filtering across log records. In this case, a KQL query accidentally compares case-sensitive resource IDs and misses results. “Summarize counts by type, sort descending and take five” would not satisfy that requirement; the supported action is “Use appropriate KQL string comparison semantics and normalized identifiers”. KQL has multiple comparison operators with different case behavior.

Ranked summaries require grouping rather than raw event display. In this case, a KQL query accidentally compares case-sensitive resource IDs and misses results. “Aggregate counts by a chosen dimension before sorting” would not satisfy that requirement; the supported action is “Use appropriate KQL string comparison semantics and normalized identifiers”. KQL has multiple comparison operators with different case behavior.

Packet-level evidence complements aggregate connectivity metrics. In this case, a KQL query accidentally compares case-sensitive resource IDs and misses results. “A bounded packet capture during the incident window” would not satisfy that requirement; the supported action is “Use appropriate KQL string comparison semantics and normalized identifiers”. KQL has multiple comparison operators with different case behavior.

Selective predicates isolate relevant records from the workspace tables. In this case, a team requires a report of top five resource types by alert count. “Use where on the resource identifier and severity or error fields” would not satisfy that requirement; the supported action is “Summarize counts by type, sort descending and take five”. KQL supports aggregation and top-N filtering across log records.

KQL has multiple comparison operators with different case behavior. In this case, a team requires a report of top five resource types by alert count. “Use appropriate KQL string comparison semantics and normalized identifiers” would not satisfy that requirement; the supported action is “Summarize counts by type, sort descending and take five”. KQL supports aggregation and top-N filtering across log records.

Incident integration requires a functioning receiver in addition to an alert rule. In this case, a team requires a report of top five resource types by alert count. “Webhook endpoint, authentication and action group association” would not satisfy that requirement; the supported action is “Summarize counts by type, sort descending and take five”. KQL supports aggregation and top-N filtering across log records.

Incident integration requires a functioning receiver in addition to an alert rule. In this case, a workbook displays all alert rows but managers need a ranked summary. “Webhook endpoint, authentication and action group association” would not satisfy that requirement; the supported action is “Aggregate counts by a chosen dimension before sorting”. Ranked summaries require grouping rather than raw event display.

Action groups can integrate selected alert events with supported webhook endpoints. In this case, a workbook displays all alert rows but managers need a ranked summary. “An action group webhook receiver with appropriate security controls” would not satisfy that requirement; the supported action is “Aggregate counts by a chosen dimension before sorting”. Ranked summaries require grouping rather than raw event display.

KQL has multiple comparison operators with different case behavior. In this case, a workbook displays all alert rows but managers need a ranked summary. “Use appropriate KQL string comparison semantics and normalized identifiers” would not satisfy that requirement; the supported action is “Aggregate counts by a chosen dimension before sorting”. Ranked summaries require grouping rather than raw event display.

Log costs reflect collected volume and retention policies. In this case, an organization needs to notify an on-call system through an HTTP endpoint when a critical metric alert fires. “Diagnostic category selection, workspace retention and ingestion controls” would not satisfy that requirement; the supported action is “An action group webhook receiver with appropriate security controls”. Action groups can integrate selected alert events with supported webhook endpoints.

Metrics and log ingestion have different pricing and collection paths. In this case, an organization needs to notify an on-call system through an HTTP endpoint when a critical metric alert fires. “Filter or scope the high-volume diagnostic log categories” would not satisfy that requirement; the supported action is “An action group webhook receiver with appropriate security controls”. Action groups can integrate selected alert events with supported webhook endpoints.

Ranked summaries require grouping rather than raw event display. In this case, an organization needs to notify an on-call system through an HTTP endpoint when a critical metric alert fires. “Aggregate counts by a chosen dimension before sorting” would not satisfy that requirement; the supported action is “An action group webhook receiver with appropriate security controls”. Action groups can integrate selected alert events with supported webhook endpoints.

Metrics and log ingestion have different pricing and collection paths. In this case, a metric alert is visible in portal but its external incident system never receives events. “Filter or scope the high-volume diagnostic log categories” would not satisfy that requirement; the supported action is “Webhook endpoint, authentication and action group association”. Incident integration requires a functioning receiver in addition to an alert rule.

Ranked summaries require grouping rather than raw event display. In this case, a metric alert is visible in portal but its external incident system never receives events. “Aggregate counts by a chosen dimension before sorting” would not satisfy that requirement; the supported action is “Webhook endpoint, authentication and action group association”. Incident integration requires a functioning receiver in addition to an alert rule.

KQL supports aggregation and top-N filtering across log records. In this case, a metric alert is visible in portal but its external incident system never receives events. “Summarize counts by type, sort descending and take five” would not satisfy that requirement; the supported action is “Webhook endpoint, authentication and action group association”. Incident integration requires a functioning receiver in addition to an alert rule.