A tugboat VM cannot reach an API VM on TCP 8443, and the night shift needs to know which NSG rule is to blame. Which Network Watcher check should they run first?
Select an answer to reveal the explanation.
Short Explanation
Want the guilty NSG rule’s name? IP flow verify is your flashlight—source, dest, port, protocol, direction—Allow or Deny with the rule called out. Don’t start with packet capture theater.
Full Explanation
Network Watcher IP flow verify evaluates whether traffic would be allowed or denied by NSG rules for a given five-tuple and reports the responsible rule name. That makes it the first security-engineer check for NSG evaluation failures. Packet capture is heavier and usually comes later. Sentinel analytics rules and disabling NSGs in production are not the targeted diagnostic for naming the denying rule.