A water-lab engineer saved a security admin configuration that denies inbound Internet to a network group, then opened a test VM and found the port still reachable. What step is missing?
Select an answer to reveal the explanation.
Short Explanation
Saving an AVNM config is like drafting a city ordinance—nothing sticks until you deploy it to the regions that host those VNets.
Full Explanation
Azure Virtual Network Manager security configurations must be created, associated with a network group, and then deployed to the relevant regions before they enforce. A saved but undeployed configuration is only a draft and does not block traffic. NSG flow logs can help verify later behavior but do not activate an undeployed admin config. Deleting the network group or converting NSGs to ASGs does not deploy the draft.