How to Identify the Blocking NSG Rule Using IP Flow Verify
A VM in a subnet cannot connect to another VM on TCP 1433. The administrator wants to confirm whether an NSG rule is blocking the flow and which rule is responsible. Which Network Watcher feature should be used?
Quick Answer
The answer is IP flow verify, a Network Watcher feature that directly identifies the blocking NSG rule. This tool tests a specific traffic flow by simulating a packet between a source and destination VM, then evaluating all effective security rules—including Network Security Groups and Application Security Groups—to determine if the traffic is allowed or denied. When a connection on TCP 1433 fails, IP flow verify not only confirms the block but returns the exact rule name, priority, and direction responsible, making it the precise diagnostic tool for this scenario. On the AZ-104 exam, this question tests your ability to differentiate Network Watcher tools: IP flow verify is for rule-level troubleshooting, while NSG diagnostics or topology might be traps. A common memory tip is to think of IP flow verify as a “packet detective” that traces the path and points a finger at the guilty rule.
⚠ Common exam trap
It's easy for candidates to confuse Connection troubleshoot (which tests end-to-end connectivity but does not identify the blocking rule) with IP flow verify, which is the precise tool for rule-level diagnosis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP flow verify
B is correct because IP flow verify is the Network Watcher feature specifically designed to test whether traffic is allowed or denied to or from a virtual machine. It checks the security rules (NSG and ASG) and returns which rule is blocking the flow, including the direction and priority. For a TCP 1433 connection failure, this tool directly identifies the blocking NSG rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Connection troubleshoot
Why it's wrong here
Connection troubleshoot checks end-to-end reachability, but it does not specifically identify the exact NSG rule decision as directly as flow verification does.
When this WOULD be correct
Connection troubleshoot would be correct if the question asked to diagnose end-to-end connectivity issues such as high latency, packet loss, or routing problems between two VMs, rather than identifying which NSG rule is blocking a specific TCP port.
- ✓
IP flow verify
Why this is correct
IP flow verify is designed to test whether a specific packet would be allowed or denied by the effective NSG rules on a VM NIC. It helps the administrator identify the rule name and direction that controls the flow. That makes it the best choice when the question is specifically about an NSG decision on a given source, destination, protocol, and port.
- ✗
Packet capture
Why it's wrong here
Packet capture is useful for analyzing traffic content, but it does not directly tell you which NSG rule blocked the flow.
When this WOULD be correct
When an administrator needs to capture network packets to analyze application-level protocol issues or to perform deep packet inspection for troubleshooting performance problems, such as identifying malformed packets or retransmissions.
- ✗
Effective routes
Why it's wrong here
Effective routes show path selection, not whether a security rule is allowing or denying traffic on a port.
When this WOULD be correct
When troubleshooting why a VM cannot reach a destination due to routing issues, such as missing or incorrect user-defined routes (UDRs), or when verifying the next hop for traffic.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓IP flow verifyCorrect answer▾
Why this is correct
IP flow verify is designed to test whether a specific packet would be allowed or denied by the effective NSG rules on a VM NIC. It helps the administrator identify the rule name and direction that controls the flow. That makes it the best choice when the question is specifically about an NSG decision on a given source, destination, protocol, and port.
✗Connection troubleshootWrong answer — click to see why▾
Why this is wrong here
Connection troubleshoot checks connectivity issues like latency, packet loss, and path hops, but it does not identify which specific NSG rule is blocking traffic. IP flow verify is designed to test whether traffic is allowed or denied by NSG rules and to pinpoint the exact rule responsible.
★ When this WOULD be the correct answer
Connection troubleshoot would be correct if the question asked to diagnose end-to-end connectivity issues such as high latency, packet loss, or routing problems between two VMs, rather than identifying which NSG rule is blocking a specific TCP port.
Why candidates choose this
Candidates may confuse 'connection troubleshoot' with verifying NSG rules because both involve testing network connectivity, but connection troubleshoot focuses on broader network performance issues rather than rule-level analysis.
✗Packet captureWrong answer — click to see why▾
Why this is wrong here
Packet capture captures network traffic for analysis but does not directly identify which NSG rule is blocking traffic; it requires manual inspection of captured data and does not provide a rule-level verdict.
★ When this WOULD be the correct answer
When an administrator needs to capture network packets to analyze application-level protocol issues or to perform deep packet inspection for troubleshooting performance problems, such as identifying malformed packets or retransmissions.
Why candidates choose this
Candidates may think packet capture can reveal blocked traffic by examining captured packets, but they overlook that IP flow verify is specifically designed to test and identify NSG rule effects without capturing full traffic.
✗Effective routesWrong answer — click to see why▾
Why this is wrong here
Effective routes shows the effective routes for a VM, not NSG rules. It cannot identify which NSG rule is blocking traffic on TCP 1433.
★ When this WOULD be the correct answer
When troubleshooting why a VM cannot reach a destination due to routing issues, such as missing or incorrect user-defined routes (UDRs), or when verifying the next hop for traffic.
Why candidates choose this
Candidates may confuse effective routes with NSG rule verification, thinking that route tables also control traffic flow like NSGs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Azure AD Connect and Hybrid Identity
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A VM named VM1 cannot establish TCP 1433 connectivity to VM2. The administrator wants to test the exact flow, confirm whether an NSG allows or denies it, and identify the rule that applies if the flow is blocked. Which Network Watcher tool should be used?
hard- A.Effective routes, because it shows the exact NSG rule name for blocked traffic.
- ✓ B.IP flow verify, because it evaluates the 5-tuple and reports the matching allow or deny rule.
- C.Packet capture, because it automatically tells you which NSG rule denied the traffic.
- D.Connection troubleshoot, because it only checks DNS name resolution.
Why B: IP flow verify is the correct tool because it evaluates the 5-tuple (source IP, destination IP, source port, destination port, and protocol) against the effective Network Security Group (NSG) rules for a given virtual machine network interface. It explicitly reports whether the traffic is allowed or denied and, if denied, identifies the exact NSG rule (name and priority) that caused the denial. This directly meets the administrator's requirement to test the exact flow and identify the blocking rule.
Variation 2. A VM cannot connect to another VM on TCP 1433. You need to determine whether an NSG is blocking the flow and identify which rule applies. Which Network Watcher tool should you use?
medium- A.Packet capture
- ✓ B.IP flow verify
- C.Connection troubleshoot
- D.Effective routes
Why B: IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific VM, based on a 5-tuple (source IP, destination IP, protocol, source port, destination port). For TCP 1433 (SQL Server), you can specify the exact flow parameters, and IP flow verify will evaluate all effective security rules, including NSG rules, and return the specific rule that allowed or denied the traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.