Microsoft - AZ-801: Configuring Windows Server Hybrid Advanced Services

Sample Questions

Explanation:

Boot diagnostics is a debugging feature for Azure virtual machines (VM) that allows diagnosis of VM boot failures. Boot diagnostics enables a user to observe the state of their VM as it is booting up by collecting serial log information and screenshots.

When you create a VM in Azure portal, boot diagnostics is enabled by default. The recommended boot diagnostics experience is to use a managed storage account, as it yields significant performance improvements in the time to create an Azure VM. An Azure managed storage account is used, removing the time it takes to create a user storage account to store the boot diagnostics data.

The boot diagnostics data blobs (which comprise of logs and snapshot images) are stored in a managed storage account.

Reference: Azure boot diagnostics

Explanation:

Packet Monitor (Pktmon) is an in-box, cross-component network diagnostics tool for Windows. It can be used for advanced packet capture and event collection, drop detection, filtering, and counting. Pktmon is especially helpful in virtualization scenarios such as container networking and SDN, because it provides visibility within the networking stack.

Pktmon filter add allows you to add a filter to control which packets are reported. For a packet to be reported, it must match all conditions specified in at least one filter. Up to 32 filters can be active at once.

Examples

The following filter will capture all the SYN packets sent or received by the IP address 10.0.0.10:

C:\Test> pktmon filter add -i 10.0.0.10 -t tcp syn

References:

pktmon

pktmon filter add

Explanation:

System Insights capabilities in Windows Server use predictive analytics to help administrators forecast resource usage and optimize server performance.

A System Insights capability is a machine learning or statistics model that analyzes system data to give you more insight into your deployment. System Insights includes a set of default capabilities, and you can add new capabilities dynamically without updating the operating system.

The four default capabilities available are:

• CPU capacity forecasting
• Networking capacity forecasting
• Total storage consumption forecasting
• Volume consumption forecasting

Each capability runs locally on a Windows Server instance, and you can manage each capability individually.

Each capability analyzes past historical data to predict future usage, and all of the forecasting capabilities are designed to forecast long-term trends rather than short-term behavior, helping administrators correctly provision hardware and tune their workloads to avoid future resource contention. Because these capabilities focus on long-term usage, these capabilities analyze daily data.

References:

System Insights capabilities in Windows Server

Manage System Insights capabilities in Windows Admin Center

Add and develop capabilities in System Insights

Explanation:

Alerts help you detect and address issues before users notice them by proactively notifying you when Azure Monitor data indicates there might be a problem with your infrastructure or application.

You can alert on any metric or log data source in the Azure Monitor data platform.

Activity log alerts are triggered when a new activity log event occurs that matches defined conditions.

Reference: What are Azure Monitor alerts?

Explanation:

Network security group (NSG) flow logging is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through a network security group. Flow data is sent to Azure Storage from where you can access it and export it to any visualization tool, security information and event management (SIEM) solution, or intrusion detection system (IDS) of your choice.

How NSG flow logs work

Key properties of NSG flow logs include:

• Flow logs operate at Layer 4 of the Open Systems Interconnection (OSI) model and record all IP flows going in and out of a network security group.
• Logs are collected at 1-minute intervals through the Azure platform. They don't affect your Azure resources or network performance in any way.
• Logs are written in JSON format and show outbound and inbound flows per network security group rule.
• Each log record contains the network interface (NIC) that the flow applies to, 5-tuple information, the traffic decision, and (for version 2 only) throughput information.
• NSG flow logs have a retention feature that allows deleting the logs automatically up to a year after their creation.

Reference: Flow logging for network security groups