Packets from Cascade Regional Airlines' internal API VM destined for the on-premises reservations database are silently failing to arrive, and the network team suspects a misconfigured user-defined route is sending traffic somewhere other than the VPN gateway. Which Network Watcher tool identifies the actual next hop a packet takes toward a given destination?

Next hop is a Network Watcher capability that, given a source VM and a destination IP, evaluates the VM NIC's effective routes and reports the type of next hop the traffic will actually take — such as VirtualNetworkGateway, Internet, VNetLocal, VirtualAppliance, or None — which directly reveals whether a misconfigured user-defined route is diverting on-premises-bound traffic away from the VPN gateway. IP flow verify instead answers an NSG allow/deny question for a specific flow; it doesn't report which route or hop the traffic would take, only whether a security rule would permit it. NSG flow logs record historical accept/deny decisions logged by NSGs over time, which helps with auditing but doesn't identify routing behavior at all, since NSGs and route tables are independent constructs. Connection monitor performs continuous, longer-term connectivity monitoring between endpoints with latency and packet-loss trending, which is a broader observability tool rather than a quick point-in-time routing lookup. The exam-relevant caveat: Next hop reflects effective routes, meaning the combination of the system route, any user-defined route table associated with the subnet, and BGP-learned routes from a gateway, so a route table misconfiguration at the subnet level will show up here even if the individual VM has no explicit UDR assigned. To verify a fix, rerun Next hop for the same source and destination and confirm the result now reports VirtualNetworkGateway instead of Internet or None.