A virtual machine in Cascade Regional Airlines' baggage-tracking subnet has both a subnet-level NSG and a NIC-level NSG applied, and the security team is troubleshooting unexpected blocked traffic but isn't sure which combined set of rules is actually being enforced on that VM. Which Network Watcher tool shows the full, merged rule set actually applied to the VM?

Effective security rules is a Network Watcher diagnostic that, for a given network interface, merges and displays the complete set of security rules actually being enforced — combining both the subnet-level NSG and the NIC-level NSG, expanding any application security groups referenced, and resolving service tags into their underlying address ranges — giving a single authoritative view instead of requiring the engineer to manually reconcile two separate rule sets. IP flow verify tests one specific flow (a given source, destination, port, and protocol) and returns a single allow/deny verdict, which is useful once you already suspect a specific flow but doesn't provide the broader combined-rule listing needed when the cause is unclear. Next hop answers a routing question about which path traffic will take, which is unrelated to NSG rule evaluation entirely. NSG flow logs capture a historical record of flows evaluated over time for later analysis, rather than presenting the current, combined, point-in-time rule set applied to a NIC. The exam-relevant caveat: because effective security rules resolves both subnet and NIC NSGs together, a rule that looks fine in isolation at one level can still be overridden or duplicated by a conflicting rule at the other level, and this tool is the only one that reveals that interaction directly. To verify, run effective security rules against the baggage-tracking VM's NIC and check for a deny rule with a lower priority number than an expected allow rule, since lower priority numbers are evaluated first.