A user reports that they cannot connect from their Azure VM to a specific on-premises IP address over an ExpressRoute connection. You need to determine exactly which hop or security rule is blocking the traffic. Which Network Watcher tool should you use?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Connection Troubleshoot

Connection Troubleshoot checks connectivity between a source VM and a destination (IP, FQDN, or URI). It traces the route hop-by-hop, identifies reachability issues, latency, and e...

๐Ÿ“‹Part of Microsoft Certified: Azure Network Engineer Associate (AZ-700) ยท Azure Certification Practice
Real Exam ScenarioNetwork Watcher

A user reports that they cannot connect from their Azure VM to a specific on-premises IP address over an ExpressRoute connection. You need to determine exactly which hop or security rule is blocking the traffic. Which Network Watcher tool should you use?

โœ“ Correct Answer & ExplanationNetwork Watcher

Correct Answer

Connection Troubleshoot

Why This Answer Is Correct

Connection Troubleshoot checks connectivity between a source VM and a destination (IP, FQDN, or URI). It traces the route hop-by-hop, identifies reachability issues, latency, and explicitly calls out if an NSG rule or a routing issue is blocking the connection. IP Flow Verify only checks NSG rules on the source VM.

๐Ÿ“š What This Question Tests

This question evaluates your knowledge of Network Watcher โ€” a core concept tested in Microsoft Certified: Azure Network Engineer Associate (AZ-700). Understanding Network Watcher is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.