A VM can't reach a database on another subnet. Which Network Watcher tool simulates a packet from source to destination and shows which NSG rule or route blocks it?
A.Packet capture
Capture records real packets — doesn't identify blocking rules.
B.IP flow verify
IP flow verify = point-in-time 'which rule blocks this flow'. Correct.
C.Connection monitor
Connection monitor is continuous monitoring, not diagnostic simulation.
D.NSG flow logs
Flow logs log flows — analysis requires reading logs, not instant verdicts.
Why this answer
IP flow verify tests a specific 5-tuple (src/dst IP+port+protocol) and reports allow/deny plus the responsible NSG rule. Packet capture records actual packets; connection monitor is ongoing latency/connectivity tracking; flow logs record what happened, not simulate it.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Virtual Networking practice session.
Practice Virtual Networking