Question

You manage a subnet named subnet-app that hosts application VMs. Security policy requires that these VMs must not initiate outbound connections to the public internet, but they must still be able to reach Azure Storage in the same region over the Microsoft backbone. You want to enforce this using a network security group with the least administrative overhead and without maintaining IP address lists. Which two outbound rules should you configure (from highest to lowest evaluated priority)?

Accepted Answer

A higher-priority Allow rule with destination service tag Storage.<region>, then a lower-priority Deny rule with destination service tag Internet

Answer

A higher-priority Deny rule with destination service tag Internet, then a lower-priority Allow rule with destination service tag Storage.<region>

Answer

A higher-priority Allow rule with destination service tag Internet, then a lower-priority Deny rule with a manually maintained list of storage IP ranges

Answer

A single Deny rule with destination service tag VirtualNetwork, relying on the default AllowInternetOutbound rule for storage access