Two Windows Server VMs, VM1 and VM2, reside in Subnet1 of VNet1. Prevent VM1 from accessing VM2 on TCP port 3389. What should you do?

To prevent VM1 from accessing VM2 on TCP port 3389, an outbound rule on VM1 is needed. An NSG applied to VM1's network interface with an outbound rule denying destination port 3389 will block VM1's attempts to connect to VM2 on that port. Deploying Azure Bastion is for secure RDP/SSH access to VMs from the internet, not for controlling traffic between VMs within a VNet. An outbound rule denying source port 3389 is incorrect because source ports are typically ephemeral and not used for filtering specific service access. An inbound rule denying source port 3389 on Subnet1 would not prevent VM1 from initiating a connection to VM2; it would affect incoming connections to resources in Subnet1 from external sources on that specific source port, which is not the requirement.