A support engineer reports that an application server VM (private IP 10.2.1.10) cannot receive inbound HTTPS (TCP 443) connections from an on-premises client (203.0.113.25). The VM has an NSG on its subnet and a second NSG on its network interface. You need to quickly determine whether an NSG rule is blocking the traffic and, if so, which specific rule and which NSG is responsible — without capturing packets or installing agents. Which Azure Network Watcher tool should you use?