The kiosk subnet at Cascade Regional Airlines only needs to send data out to the booking API over HTTPS; the kiosks should never be able to initiate any other outbound connection. Where should this restriction be configured?
Select an answer to reveal the explanation.
Short Explanation
Inbound and outbound are two completely separate rule books in an NSG, even though they live in the same resource. If the goal is controlling what the kiosks are allowed to reach on their way out, that's an outbound rule, full stop.
Full Explanation
NSGs maintain independent inbound and outbound rule sets, each evaluated separately by priority for traffic in that direction; a rule written for one direction has no effect on the other. To restrict what the kiosk subnet can initiate outward, the engineer needs a custom outbound rule denying all destinations and ports except an explicit allow for HTTPS (port 443) to the booking API's address or service tag, placed at a lower priority number than the general deny so it is evaluated first. The inbound-rule distractor misunderstands the rule model entirely — an inbound deny would only affect traffic arriving at the kiosks, not traffic they send out. The AllowVnetOutBound distractor is wrong because that default rule permits outbound traffic to the entire virtual network, not just to one approved destination; it does nothing to stop a kiosk from reaching other internal resources or the internet at large. The public-IP distractor invents a capability public IP address resources do not have; they are just addresses, not policy enforcement points. After configuring the rule, the engineer should verify it by attempting an outbound connection to a disallowed destination from a kiosk VM and confirming it times out or is refused.