A spoke team allowed RDP from the Internet on their subnet NSG. The central security engineer must close that path on every spoke without chasing each NSG. What should they deploy?
Select an answer to reveal the explanation.
Short Explanation
Stop whack-a-mole on every spoke NSG. Drop an AVNM security admin Deny for Internet-to-3389—admin Deny lands before the local NSG can reopen the hole.
Full Explanation
Azure Virtual Network Manager security admin rules are evaluated before NSGs. A Deny security admin rule for TCP 3389 from Internet can close RDP exposure across many spoke VNets in a network group without chasing each subnet NSG the spoke team edited. That is the central control needed after a spoke allowed RDP from the Internet.
An Azure Policy initiative that only audits NSG rules fails because audit does not block traffic at evaluation time. A Conditional Access grant control fails by concept: Conditional Access governs Entra sign-in to cloud apps, not TCP 3389 to VM endpoints. A user-defined route sending all RDP to next hop Internet fails and can worsen exposure.
Exam caveat: security admin rules provide centrally enforced guardrails above NSGs—use Deny for Internet RDP and SSH baselines. Operational check: place production spokes in a network group, create and deploy a Deny 3389 from Internet admin rule, verify IP flow shows deny even if a local NSG allows, and leave Bastion or JIT as the approved admin path. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.