Note: This question is part of a series that share the same scenario. Each question proposes a distinct solution that might meet the goals. After you answer, you cannot return to this question. You have an Azure subscription that contains: • A virtual network named Vnet1 • A subnet named Subnet1 in Vnet1 • A virtual machine named VM1 connected to Subnet1 • Three storage accounts named storage1, storage2, and storage3 You must allow VM1 to access storage1 but prevent VM1 from accessing any other storage accounts. Solution: Create a network security group (NSG) and associate it with Subnet1. Does this solution achieve the requirement?

No, this solution does not achieve the requirement. While an NSG can control network traffic to and from Subnet1, it operates at the IP address and port level. To specifically allow access to storage1 while blocking storage2 and storage3, you would need to know the public IP addresses of these storage accounts, which can change. Furthermore, NSGs cannot differentiate between specific Azure resources of the same type (e.g., different storage accounts) using only IP addresses. A more granular solution, such as using a Service Endpoint for Azure Storage on Subnet1 combined with a Network Rule on storage1, would be required. This allows storage1 to accept traffic from Subnet1 while storage2 and storage3 would reject it.