Contoso Ltd. has a web VM (appvm01) in resource group web-rg connected to NIC appvm01-nic protected by NSG nsg-web. Clients report that HTTPS traffic from a specific client IP 203.0.113.45 to the VM's private IP 10.2.1.4:443 is failing. You need to determine whether an NSG is allowing or denying that specific flow and which rule matched. What is the fastest correct way to diagnose this from Azure's Network Watcher features?

Network Watcher's IP Flow Verify is designed precisely for this scenario. It simulates a 5-tuple (source IP, destination IP, source port, destination port, protocol) flow and reports whether the traffic is allowed or denied by NSGs, and which specific NSG rule was responsible. This provides immediate, definitive answers about NSG behavior without requiring any configuration changes or waiting. The other options are less efficient or suitable. Running tcpdump on the VM would only show traffic reaching the OS, not if an NSG blocked it beforehand, and requires VM access. NSG flow logs provide historical data and require enabling and waiting, which isn't the "fastest" way to diagnose an immediate issue. Azure Monitor Network Insights flow map offers a visual overview but doesn't pinpoint specific rule-based blocking for a particular flow.