Microsoft Azure Administrator Associate AZ-104 Practice Question

The 'IP flow verify' feature in Azure Network Watcher is used to check if a packet is allowed or denied to or from a virtual machine. It tests the traffic against configured network security group (NSG) rules and returns the specific rule that allowed or denied the traffic. This makes it the correct tool for the scenario. 'Connection troubleshoot' provides a comprehensive, point-in-time connection check but does not specify which NSG rule is responsible for a failure. 'Packet capture' collects raw network traffic for deep analysis but does not directly report on NSG rule evaluations. 'Next hop' is used to diagnose routing issues by showing the next hop in the traffic path, not for checking security rules.