Question

Your company hosts a set of application VMs in a subnet named Subnet-App within a virtual network. Security policy requires that these VMs be able to communicate with other resources inside the same virtual network but must be completely blocked from initiating any outbound connections to the public internet. You want to enforce this using an NSG applied to Subnet-App with the minimum number of custom rules. Which approach should you use?

Accepted Answer

Create one outbound custom rule that denies traffic to the Internet service tag with a priority number lower than the default AllowInternetOutBound rule.

Answer

Create one outbound custom rule that denies traffic to the Internet service tag with a priority number higher than the default AllowVnetOutBound rule.

Answer

Create one outbound custom rule that allows traffic to the VirtualNetwork service tag and one inbound rule that denies the Internet service tag.

Answer

Remove the default AllowVnetOutBound rule and create a single rule that denies all outbound traffic.