A web application on a VM is failing on TCP 8443. The administrator wants to capture packets on the VM NIC to inspect retransmissions and handshake details after the test run. Which Network Watcher capability should be used?

IP flow verify

IP flow verify only tells you whether an NSG rule allows or blocks a flow, not the packet contents.

Connection troubleshoot

Connection troubleshoot tests connectivity, but it does not provide captured packets for later analysis.

Effective routes

Effective routes helps with path selection, but it does not capture actual packet data.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Packet capture — Packet capture is the Network Watcher tool used when you need packet-level evidence. It can record traffic on a VM NIC and let you review SYNs, retransmissions, resets, or other low-level details after the test. That makes it far more useful than route or NSG verification when the issue may be inside the actual network conversation. Why others are wrong: IP flow verify checks NSG filtering only. Connection troubleshoot tests reachability, but it does not preserve packet payloads or timing details. Effective routes is for examining routing decisions, not packet contents. Since the administrator explicitly wants to inspect the traffic exchange later, packet capture is the only option that fits.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.