A development team reports that a newly deployed application running on a Compute Engine VM in a custom VPC cannot reach a Cloud SQL instance over a private IP. Before making any changes, they ask you, the architect, how they can programmatically confirm whether the network path and firewall rules actually permit the traffic without generating live application requests. Which Google Cloud approach should you advise them to use first?