VNet1 contains Subnet1 with three VMs, each with a public IP. Apps are available to Internet users over port 443. There is a site-to-site VPN from on-premises to VNet1. VMs are reachable by RDP from both the Internet and on-premises. You must block RDP from the Internet but allow RDP from the on-premises network, while keeping the apps available to Internet users. What should you implement?

Creating a deny rule in a Network Security Group (NSG) linked to Subnet1 is the correct solution. NSGs allow you to filter network traffic to and from Azure resources. You would create an inbound security rule with a higher priority (lower number) than existing allow rules. This rule would specify a source of "Any" or "Internet" for RDP (port 3389) and an action of "Deny." This blocks RDP from the internet. Simultaneously, you would ensure an existing or new allow rule permits RDP from your on-premises network's IP range, as NSG rules are processed by priority. This approach maintains internet access to applications on port 443 and on-premises RDP access. Modifying the address space of the local network gateway or Subnet1 would disrupt connectivity and not directly control RDP access. Removing public IP addresses would make the applications unavailable to internet users, which contradicts a requirement.