Night-shift monitoring must reach every lock VM on TCP 443 from a jump subnet, but app teams keep adding Deny rules that break the probes. Which Azure Virtual Network Manager action should the security engineer use?
Select an answer to reveal the explanation.
Short Explanation
Probes keep dying under local Deny graffiti. Use an AVNM AlwaysAllow for jump-subnet-to-443—NSGs never get a vote on that path.
Full Explanation
Security admin rule actions behave differently: AlwaysAllow permits the traffic and skips further NSG evaluation so local Denys cannot block it; Allow still permits NSG evaluation afterward; Deny drops traffic. For night-shift monitoring that must reach every lock VM on TCP 443 from a jump subnet despite app teams adding Deny rules, use AlwaysAllow for that management flow so probes cannot be broken by local NSGs.
Using Allow fails because NSG evaluation continues and local Denys can still block probes. Using Deny drops monitoring traffic. Just-in-time VM access on each lock VM fails as a substitute for a network-wide management allow for continuous probes—JIT unlocks ports temporarily for admin access, not AVNM AlwaysAllow semantics.
Exam caveat: AlwaysAllow is powerful—limit it to tightly sourced management flows. Operational check: deploy AlwaysAllow from the jump subnet to lock VMs on TCP 443, add a conflicting Deny in a subnet NSG, confirm probes still succeed, and audit who can create AlwaysAllow rules. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.