A lock-chamber VM sits on a subnet that already has an NSG, and operators also pinned a second NSG to the NIC. Inbound SSH from the harbor-pilot jump host still fails. What should the security engineer understand about effective rules?
Select an answer to reveal the explanation.
Short Explanation
Two NSGs on the path aren’t a relay race—they’re a double filter. Subnet and NIC both apply, and the stingiest allow/deny wins. Check effective security rules.
Full Explanation
When an NSG is associated with both the subnet and the NIC, inbound and outbound traffic is evaluated against both associations. Effective security rules combine them, and the most restrictive outcome wins—an allow at one layer does not override a deny at the other. The NIC NSG does not replace the subnet NSG. Azure Firewall is a separate control and is not required to explain this failure mode. Rule name ordering is irrelevant to evaluation.