A VM in a subnet cannot connect to another VM on TCP 1433. The administrator wants to confirm whether an NSG rule is blocking the flow and which rule is responsible. Which Network Watcher feature should be used?

Connection troubleshoot

Connection troubleshoot checks end-to-end reachability, but it does not specifically identify the exact NSG rule decision as directly as flow verification does.

Packet capture

Packet capture is useful for analyzing traffic content, but it does not directly tell you which NSG rule blocked the flow.

Effective routes

Effective routes show path selection, not whether a security rule is allowing or denying traffic on a port.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: IP flow verify — IP flow verify is the Network Watcher tool used to determine whether a packet would be allowed or denied by NSG processing and to identify the rule that applies. Because the issue is a suspected NSG block on TCP 1433, you need a tool that evaluates security rules rather than routing or packet contents. This makes IP flow verify the most direct and appropriate diagnostic choice for this scenario. Why others are wrong: A is broader and more focused on connectivity testing than on pinpointing the specific NSG decision. C captures packets for deeper analysis but is not the fastest way to find an NSG rule match. D is about routing, not access control.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.