A jump host cannot open RDP (TCP 3389) to a VM in another subnet. You need to know which NSG rule, if any, allows or denies that exact flow, and you want a fast answer. Which Network Watcher tool should you run?
Show answer and explanation
Answer: C
IP flow verify takes a source, destination, protocol and port, then evaluates the NSG rules that apply to the VM's network interface and subnet. It reports whether the flow is allowed or denied and names the matching rule, which makes it well suited to quick single-flow troubleshooting.
Why the other options are wrong
- A. Next hop lookup shows the routing decision for a destination address. It does not evaluate NSG rules or report whether a specific port is permitted.
- B. The effective security rules view lists the combined NSG rules on an interface. It shows what is configured but does not test one specific flow to a destination.
- D. Traffic Analytics summarizes flow log data over time for trends and security insight. It is not an immediate allow-or-deny test for one connection attempt.