Intermittent latency is reported from a VM in a spoke VNet to an Azure SQL Database reached via Private Endpoint in the hub. You must (1) continuously monitor reachability and latency, (2) capture packets on the VM NIC during incidents without logging into the VM, (3) confirm which NSG rules allow/deny flows, and (4) visualize the involved topology. What set of Network Watcher capabilities best meets the requirements?

The correct option leverages specific Network Watcher capabilities to address each requirement. Connection Monitor (v2) provides continuous, end-to-end reachability and latency monitoring, fulfilling requirement (1). On-demand packet capture on the VM NIC allows capturing network traffic without logging into the VM, meeting requirement (2). NSG flow logs v2 with Traffic Analytics records all network flows through NSGs and provides insights into allowed/denied traffic, directly addressing requirement (3). Finally, the Topology view visualizes the network layout and interconnections, satisfying requirement (4). Incorrect options: IP flow verify is for real-time rule validation, not continuous monitoring. Packet capture on a SQL managed instance is not possible, and effective routes don't show NSG rule impact. Connection Monitor (classic) is deprecated. VM insights and Activity Logs are broader monitoring tools but don't offer the specific NSG flow analysis or packet capture needed. NSG diagnostics alone do not include packet capture or topology visualization out of the box; these are separate Network Watcher features. Application Insights dependency maps focus on application-level dependencies, not the detailed network-level diagnostics required here, and Network Watcher is essential for these tasks.