Compost-lab front-end VMs must reach only the mid-tier VMs on TCP 8443, not every NIC covered by the VirtualNetwork service tag. What NSG design should the security engineer apply?
Select an answer to reveal the explanation.
Short Explanation
Don’t throw VirtualNetwork wide open like a barn door. Allow ASG-web to ASG-api on 8443 and let the default deny muzzle the rest of east-west.
Full Explanation
Least-privilege east-west design uses Application Security Groups so only the intended tiers communicate on the required port. An explicit allow from ASG-web to ASG-api on TCP 8443, combined with default deny behavior, blocks broader VirtualNetwork-to-VirtualNetwork access. Blanket VirtualNetwork allows defeat micro-segmentation. Azure Firewall can add inspection later, but it is not required as the only acceptable answer for this ASG/NSG control. Exposing the mid-tier to the Internet is the wrong direction.