A VM cannot receive a TCP connection, and the engineer suspects an NSG rule. Which Network Watcher tool can identify whether the specified flow is allowed or denied by NSG rules?

1. A DNS delegation check
2. Connection monitor only
3. IP flow verify
4. A bandwidth pricing estimate