An engineer at Cascade Regional Airlines suspects a network security group rule is silently blocking traffic from the crew-scheduling app VM to the backend database VM on port 1433, but nothing in the application logs confirms it. Which Network Watcher tool directly tests whether a specific flow between two VMs is allowed or denied, and by which rule?

IP flow verify is a Network Watcher diagnostic that takes a specified source IP, destination IP, port, protocol, and traffic direction, then evaluates it against the effective security rules applied to the target VM's NIC and returns a definitive allow or deny result along with the name of the specific NSG rule responsible — which directly answers whether port 1433 traffic from the app VM to the database VM is being blocked and by what rule. Next hop instead answers a routing question: given a source and destination, it reports what the next hop type is (virtual network, internet, virtual appliance, none, and so on) based on effective routes, which is useful for tracing a path but doesn't evaluate NSG allow/deny decisions. NSG flow logs record a historical stream of all flows an NSG evaluated over time for later analysis in a log analytics workspace or storage account, which is valuable for auditing but requires log ingestion and querying rather than an immediate, on-demand answer to a single flow question. Connection troubleshoot performs an end-to-end connectivity test between a VM and a destination, reporting round-trip latency and hop-by-hop results, but it's a broader connectivity check rather than a targeted 'which rule blocked this' diagnostic. The exam-relevant caveat: IP flow verify evaluates effective security rules, meaning it accounts for both NIC-level and subnet-level NSGs combined. To verify the fix after adjusting the offending rule, rerun IP flow verify with the same parameters and confirm the result changes from Deny to Allow.