The AZ-700 exam's Network Watcher section asks you to pick the right tool for a given scenario, not just recall feature lists. Connection Monitor versus Connection Troubleshoot, IP Flow Verify versus Effective Routes — the names sound similar, but the use cases are completely different. Understanding when to use which tool is the real exam challenge.
Network Watcher's Toolkit at a Glance
Imagine a city's traffic control system. Some cameras record traffic flow around the clock, building a continuous historical record. Other devices are used on the spot to trace where a specific vehicle went. Azure Network Watcher works the same way. It activates automatically per region within your Azure subscription and offers distinct tools for distinct purposes.
Diagnostic tools include IP Flow Verify, Next Hop, Effective Routes, Effective Security Rules, and NSG Diagnostics. They answer one-time questions: "Why is this packet being dropped?" or "Where does traffic go from here?"
Monitoring tools include Connection Monitor and Connection Troubleshoot — the two most commonly confused tools on the exam. Packet Capture and Topology round out this category.
Connection Monitor — The 24/7 Security Camera
A convenience store's security camera doesn't just run when something goes wrong. It records continuously so you can go back and see exactly what happened and when. Connection Monitor works the same way.
Connection Monitor periodically and automatically measures connectivity between a set of source and destination endpoints. It collects round-trip time (RTT), packet loss percentage, and connection success rate on a continuous basis, storing the data in a Log Analytics Workspace. You can configure multiple sources and multiple destinations, and view time-series trends on a dashboard.
When you need to answer "Has latency between this VM and the on-premises server been increasing over the past week?", Connection Monitor is the right tool. It is the official successor to Network Performance Monitor.
Connection Troubleshoot — The One-Time Inspection
An apartment building manager checking whether a specific intercom unit is working doesn't rewind security footage. They simply press the button and see the result. Connection Troubleshoot is that button.
Connection Troubleshoot diagnoses connectivity between two endpoints at a single point in time. It traces the hops along the path and shows immediately where a connection is being blocked. It operates on a single source-to-destination pair, and results appear directly in the portal or CLI.
Use it when you need to know right now whether port 443 from this VM to that VM is open. It does not maintain an ongoing record.
IP Flow Verify and NSG Diagnostic Tools
Picture a checkpoint where every piece of mail must be cleared before passing through. You submit the sender address, recipient address, and mail type, and the checkpoint instantly tells you "allowed" or "blocked."
IP Flow Verify is that checkpoint. You input a 5-tuple — source IP, destination IP, source port, destination port, and protocol — and it tells you which NSG rule is allowing or blocking the traffic. It is the first tool to reach for when a specific port seems blocked for no obvious reason.
NSG Diagnostics extends IP Flow Verify by letting you test multiple traffic scenarios at once. Effective Security Rules shows the combined view of all NSG rules applied across a VM's NIC and its subnet, which is essential when multiple overlapping NSGs make it hard to see what is actually in effect.
NSG Flow Logs and Traffic Analytics
Think of a building's visitor log — every entry and exit is recorded, noting who came, through which door, and at what time. NSG Flow Logs is that visitor log for network traffic.
NSG Flow Logs records 5-tuple flow information for all traffic passing through an NSG in JSON format, storing it in a Storage Account. Version 1 captures allow/deny status only; version 2 adds byte and packet counts.
Traffic Analytics is the layer on top. It ingests the flow logs into a Log Analytics Workspace and produces visual dashboards. You can see which IP addresses generated the most traffic, spot abnormal port scans, and detect unusual patterns. Traffic Analytics cannot function without NSG Flow Logs enabled first.
Tool Selection Guide — What to Use When
| Scenario | Tool | |---|---| | Identify why a port is blocked right now | IP Flow Verify | | Monitor latency and loss trends over time | Connection Monitor | | Check connectivity between two endpoints immediately | Connection Troubleshoot | | Find the next hop for a packet | Next Hop | | View all effective routes on a NIC | Effective Routes | | See the combined NSG rules across overlapping NSGs | Effective Security Rules | | Collect traffic flow logs | NSG Flow Logs | | Visualize and analyze traffic patterns | Traffic Analytics | | Capture actual packet data | Packet Capture |
Connection Monitor means continuous; Connection Troubleshoot means one-time. IP Flow Verify means NSG allow/block; Next Hop means routing path. These four contrasts cover nearly every tool-selection trap on the exam.
Troubleshooting Scenario — Where Candidates Go Wrong
You receive an alert that a VPN-connected on-premises server can no longer reach an Azure VM. How do you approach the diagnosis?
Start with Connection Troubleshoot to find out immediately whether the connection is possible right now and where along the path it fails. If an NSG seems to be the culprit, use IP Flow Verify to confirm which rule is applying. If you need to determine whether the problem is new today or has been building over time, check Connection Monitor's historical data.
The most common exam trap is selecting Connection Troubleshoot when the scenario describes ongoing monitoring, or choosing Connection Monitor when the need is an immediate one-time check. Keywords like , , , or point to Connection Monitor. Keywords like , , or point to Connection Troubleshoot.
Exam Key Takeaways
"Continuously measure RTT and packet loss" -- Connection Monitor "Check right now if this VM can reach that server" -- Connection Troubleshoot "Is this port allowed or blocked by an NSG?" -- IP Flow Verify "All effective routing paths applied to a VM NIC" -- Effective Routes "Combined NSG rules across multiple overlapping NSGs" -- Effective Security Rules "Store 5-tuple traffic flow logs to Storage Account" -- NSG Flow Logs "Visualize Flow Logs data in Log Analytics" -- Traffic Analytics "Multiple sources and destinations with dashboard" -- Connection Monitor "Single source to single destination, immediate hop trace" -- Connection Troubleshoot "Capture actual packets from a VM" -- Packet Capture
Connection Monitor = continuous surveillance, Connection Troubleshoot = one-time check, IP Flow Verify = instant NSG allow/block lookup