AZ-104 Implement and Manage Virtual Networking Practice Question
A VM cannot connect to another VM on TCP 1433. You need to determine whether an NSG is blocking the flow and identify which rule applies. Which Network Watcher tool should you use?
⚠ Common exam trap
Test-takers frequently confuse 'Connection troubleshoot' with 'IP flow verify' because both diagnose connectivity issues, but Connection troubleshoot provides a broader end-to-end path analysis without pinpointing the exact blocking rule, whereas IP flow verify is specifically designed to test a single flow and identify the exact NSG rule that applies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP flow verify
IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific VM, based on a 5-tuple (source IP, destination IP, protocol, source port, destination port). For TCP 1433 (SQL Server), you can specify the exact flow parameters, and IP flow verify will evaluate all effective security rules, including NSG rules, and return the specific rule that allowed or denied the traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Packet capture
Why it's wrong here
Packet capture records actual network packets at a VM's network interface, capturing headers and payload for deep protocol analysis. While it can reveal whether TCP SYN packets leave the source or arrive at the destination, it does not directly map captured frames to NSG rule evaluations, and if an NSG drops the traffic before it reaches the target NIC, the packets may be entirely absent from the capture. Analyzing the capture and correlating it with NSG configuration takes significantly more time and effort than IP flow verify, which actively tests the rule engine for the exact flow.
When this WOULD be correct
Use packet capture when you need to inspect the actual data packets (e.g., payload, headers) for troubleshooting application-level issues or analyzing traffic patterns, such as verifying encryption or detecting malformed packets.
- ✓
IP flow verify
Why this is correct
IP flow verify is a Network Watcher diagnostic that tests a specific 5-tuple (source IP, destination IP, protocol, and port) against the effective NSG rules for a virtual machine's NIC. Running it with TCP and port 1433 between the two VMs instantly reports whether traffic is allowed or denied and identifies the exact rule name and priority that caused the decision. This tool is uniquely focused on NSG rule evaluation, making it the fastest way to pinpoint the rule responsible for blocking the session.
- ✗
Connection troubleshoot
Why it's wrong here
Connection troubleshoot is a Network Watcher feature that performs an end-to-end connectivity test between two VMs, checking multiple components such as DNS resolution, routing, and NSG permissions. It returns a readable 'reachable' or 'unreachable' result and may list potential causes, but it runs a broader set of checks and is slower to produce a precise answer. IP flow verify is the more targeted tool when the specific question is whether an NSG rule allows or denies TCP 1433, because it isolates the NSG rule evaluation rather than testing the entire network path.
When this WOULD be correct
Connection troubleshoot would be correct when you need to diagnose broader connectivity problems such as high latency, packet loss, or routing misconfigurations between VMs, not specifically to determine if an NSG rule is blocking traffic.
- ✗
Effective routes
Why it's wrong here
Effective routes shows the routing table in effect for a VM's NIC, including system routes, user-defined routes, and BGP-learned routes, and it determines the next hop for a given destination IP prefix. It addresses layer-3 routing decisions, not layer-4 filtering, so it cannot indicate whether an NSG permits or denies TCP port 1433. Even if the effective routes correctly deliver the packet to the destination VM, a network security group might still be blocking the session, making this tool useless for diagnosing a port-specific failure.
When this WOULD be correct
When troubleshooting connectivity issues caused by incorrect routing (e.g., missing default route or misconfigured user-defined routes), effective routes would be the correct tool to identify the problem.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓IP flow verifyCorrect answer▾
Why this is correct
IP flow verify is a Network Watcher diagnostic that tests a specific 5-tuple (source IP, destination IP, protocol, and port) against the effective NSG rules for a virtual machine's NIC. Running it with TCP and port 1433 between the two VMs instantly reports whether traffic is allowed or denied and identifies the exact rule name and priority that caused the decision. This tool is uniquely focused on NSG rule evaluation, making it the fastest way to pinpoint the rule responsible for blocking the session.
✗Packet captureWrong answer — click to see why▾
Why this is wrong here
Packet capture captures all traffic on a network interface but does not directly verify whether a specific NSG rule is blocking traffic or identify which rule applies. It requires manual analysis of captured packets to infer NSG behavior.
★ When this WOULD be the correct answer
Use packet capture when you need to inspect the actual data packets (e.g., payload, headers) for troubleshooting application-level issues or analyzing traffic patterns, such as verifying encryption or detecting malformed packets.
Why candidates choose this
Candidates may think packet capture can reveal blocked traffic by showing dropped packets, but it does not provide rule-level NSG diagnostics and is more complex than IP flow verify.
✗Connection troubleshootWrong answer — click to see why▾
Why this is wrong here
Connection troubleshoot checks for connectivity issues like latency, packet loss, and routing, but it does not specifically identify which NSG rule is blocking traffic. IP flow verify is designed to test whether traffic is allowed or denied by NSG rules and to pinpoint the exact rule.
★ When this WOULD be the correct answer
Connection troubleshoot would be correct when you need to diagnose broader connectivity problems such as high latency, packet loss, or routing misconfigurations between VMs, not specifically to determine if an NSG rule is blocking traffic.
Why candidates choose this
Candidates may think 'troubleshoot' implies a comprehensive check that includes NSG rules, but they overlook that IP flow verify is the dedicated tool for NSG rule analysis.
✗Effective routesWrong answer — click to see why▾
Why this is wrong here
Effective routes shows the effective routes applied to a VM, not NSG rules. It cannot identify whether an NSG is blocking traffic or which specific NSG rule applies.
★ When this WOULD be the correct answer
When troubleshooting connectivity issues caused by incorrect routing (e.g., missing default route or misconfigured user-defined routes), effective routes would be the correct tool to identify the problem.
Why candidates choose this
Candidates may confuse network security group rules with routing rules, thinking that effective routes includes NSG information, or they may assume that any connectivity issue is routing-related.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure AD Connect and Hybrid Identity
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.