Network Watcher & Diagnostics
Regional connectivity diagnostics: IP flow verify, next hop, connection monitor, packet capture and flow logs.
Readiness
0%
1h 40m baseline
Exam memorization points
- Network Watcher is a regional service, enabled per region, and VNet flow logs and captures are stored in the NetworkWatcherRG resource group by default.
- IP flow verify answers whether an NSG allows or denies a specific five-tuple and names the matching rule.
- Next hop returns the route type and next hop for traffic from a VM to a destination, which is the tool for routing problems.
- Connection monitor performs continuous, scheduled connectivity tests between endpoints with latency and reachability history.
- Packet capture runs through the Network Watcher agent extension and writes a capture file to a storage account or local disk.
- Flow logs record allowed and denied flows, and Traffic Analytics enriches them into traffic insights in Log Analytics.
Traps & distractors
- Using IP flow verify to debug routing. It evaluates NSGs only; use next hop for routes.
- Forgetting that Network Watcher must be enabled in the region where the VM lives.
- Running packet capture without the Network Watcher agent extension on the VM, which makes the capture unavailable.
- Assuming flow logs are free. Storage, ingestion and Traffic Analytics processing are billable.
Suggested lab
Diagnose a broken connection
Use the right tool for filtering, routing and continuous monitoring.
- 1Enable Network Watcher in your region and confirm the NetworkWatcherRG group exists.
- 2Run IP flow verify for inbound 443 and inbound 8080 and record the matching rules.
- 3Run next hop from a VM to 8.8.8.8 and then to an on-premises prefix, comparing the results.
- 4Start a packet capture for 60 seconds while generating traffic, then download and inspect it.
- 5Create a connection monitor between two VMs with a 5-minute test frequency and break connectivity intentionally.
Microsoft Learn
- Azure Network Watcher overviewdoc
- Search Microsoft Learn: Network Watcher IP flow verify next hop connection monitor packet capturesearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
Medium priority
Useful reinforcement once the critical topics are stable.
- Exam importance60% × 30% = 18.0
Learner-agnostic frequency on the real exam (3/5).
- Blueprint weight56% × 25% = 13.9
This topic's domain carries 12.5% of the exam objectives.
- Dependency leverage0% × 20% = 0.0
Nothing else in the graph depends on this topic.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Leaf topic - nothing depends on it.
Baseline study time
1h 40m
Complexity
3 / 5
Remaining to target
1h 25m
Status weight
0%
Topics: network watcher, ip flow verify, next hop, connection monitor, packet capture, flow logs
Weak neighbours in Monitoring