Northwind Services has an application VM (web-vm02 in RG app-rg) that intermittently cannot establish a TCP connection to an Azure SQL instance on 1433. You need a Network Watcher tool to test TCP connectivity from web-vm02 to the SQL FQDN:1433 and report reachability and end-to-end latency from Azure's control plane. Which Network Watcher feature should you use?

Network Watcher Connection Troubleshoot (also known as Connection Monitor in some contexts or accessible via Test-AzNetworkWatcherConnectionMonitor in PowerShell) is the correct tool because it directly tests TCP connectivity from a specified source VM to a destination FQDN and port. It provides reachability status, end-to-end latency, and identifies any network hops or security rules blocking the connection, all from Azure's control plane without needing agents on the VM. Installing the NSG Diagnostics extension is for flow logs, not direct connectivity testing or latency measurement. Packet capture requires manual analysis and doesn't provide control plane insights. Azure Monitor metric alerts on TCP retransmits detect issues but don't perform an active connectivity test or provide hop-by-hop analysis.