A spoke team allowed RDP from the Internet on their subnet NSG. The central security engineer must close that path on every spoke without chasing each NSG. What should they deploy?
Select an answer to reveal the explanation.
Short Explanation
Stop whack-a-mole on every spoke NSG. Drop an AVNM security admin Deny for Internet-to-3389—admin Deny lands before the local NSG can reopen the hole.
Full Explanation
Azure Virtual Network Manager security admin rules are evaluated before NSGs. A Deny (or AlwaysAllow) admin rule terminates further evaluation so a spoke NSG cannot reopen the prohibited path. That is the right central control to block Internet RDP across many spokes. Azure Policy can audit or deny resource definitions but is not the network-path enforcement tool described here. Conditional Access and UDRs do not replace security admin Deny for this east-west/north-south NSG bypass problem.