Question

Your company runs several VMs in the East US region. The security team needs to capture information about all allowed and denied IP traffic flowing through the production virtual network for later analysis and retention. You decide to enable virtual network flow logs in Azure Network Watcher (the successor to the retired NSG flow logs). When configuring the flow logs, which resource must you specify as the destination, and what regional constraint applies?

Accepted Answer

An Azure Storage account, which must be in the same region as the target virtual network

Answer

A Log Analytics workspace, which can reside in any Azure region regardless of the VNet location

Answer

An Event Hub namespace, which must be in the same region as the Network Watcher instance only

Answer

An Azure Storage account, which can reside in any region as long as it is in the same subscription