A network engineer manages a hub-and-spoke topology. A VM in a spoke VNet can no longer reach an on-premises database over a Site-to-Site VPN. The engineer needs to confirm whether the VM's outbound packet to the on-premises IP (TCP 1433) is being permitted or denied specifically by network security group rules, and to identify exactly which NSG rule name is responsible for the result. Which Azure Network Watcher capability should the engineer use?