tweak

Author: halkazwini

articles/network-watcher/frequently-asked-questions.yml

@@ -173,6 +173,13 @@ sections:
         answer: |
           There's currently a regional boundary when an endpoint uses Azure Monitor and Arc agents with the associated Log Analytics workspace. As a result to this limitation, the associated Log Analytics workspace must be in the same region as the Arc endpoint. Data ingested into individual workspaces can be unionized for a single view, see [Query data across Log Analytics workspaces, applications, and resources in Azure Monitor](/azure/azure-monitor/logs/cross-workspace-query).
 
+  - name: Network diagnostic tools
+    questions:
+      - question: | 
+          Are there any limitations with network diagnostics tools for Application Gateway?
+        answer: |
+          Yes. Connection troubleshoot and NSG diagnostics don't support private Application Gateway deployments. For more information, see [Private Application Gateway deployment](/azure/application-gateway/application-gateway-private-deployment).
+
   - name: Flow logs
     questions:
       - question: |
@@ -262,10 +269,3 @@ sections:
         answer: |
           Yes, you can automate network security group flow logs via Azure Resource Manager templates (ARM templates). For more information, see [Configure NSG flow logs using an Azure Resource Manager (ARM) template](quickstart-configure-network-security-group-flow-logs-from-arm-template.md).
 
-  - name: Network diagnostic tools
-    questions:
-      - question: | 
-          Are there any limitations with network diagnostics tools for Application Gateway?
-        answer: |
-          Yes. Connection troubleshoot or NSG diagnostics don't support private Application Gateway deployments. For more information, see [Private Application Gateway deployment](/azure/application-gateway/application-gateway-private-deployment).
-