Which two Network Watcher tools can help you diagnose whether a VM can reach another address and whether a specific flow is allowed or denied? Select two.

Packet capture

False because packet capture records traffic for later inspection, but it does not directly answer allow or deny decisions.

Effective routes

False because effective routes shows routing paths, not whether a specific security flow is allowed or denied.

Network topology

False because that is not the specific Network Watcher tool used for end-to-end connectivity testing.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Connection troubleshoot — Connection troubleshoot helps confirm whether one VM can reach another endpoint and can surface the component causing the failure. IP flow verify is the right tool when you want to know whether a specific packet would be allowed or denied by NSG rules. Together, they are the most practical first checks for many basic Azure networking issues. Why others are wrong: Packet capture is useful after you already know traffic is reaching the VM and you want packet details. Effective routes helps with routing decisions, not security allow or deny results. Network topology is not the dedicated troubleshooting feature for this specific reachability workflow.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.