Your Azure subscription includes 100 network security groups (NSGs). You need to capture logs that show when specific NSG rules are applied to traffic. Which type of log should you enable?

Flow logs record information about IP traffic flowing through an NSG, including source/destination IP, port, protocol, and whether the traffic was allowed or denied by a specific NSG rule. This directly addresses the need to see when NSG rules are applied. Activity logs (formerly operational logs) provide insight into subscription-level events, like resource creation or deletion, not traffic flow. Azure resource logs (formerly diagnostic logs) collect data from specific Azure resources, but for NSGs, flow logs are the specialized type for traffic analysis. Audit logs are a general term often overlapping with activity logs or security-focused logs, but not the specific mechanism for NSG traffic rule evaluation.