A VM in the subnet 'AppSubnet' can no longer reach an external HTTPS endpoint (port 443), and the application team reports intermittent failures. You need to identify whether the traffic is being blocked and, if so, precisely which network security rule or user-defined route is responsible for dropping the packets between the VM and the destination. Which Azure Network Watcher capability should you use?