VNet1's virtual machines must be able to access only Azure SQL resources in the East US region and must be prevented from accessing any Azure Storage resources. Which two outbound NSG rules should you create to meet these requirements? (Choose two.)

The first correct rule is an allow rule with the IP address range of VNet1 as the source and Sql.EastUS as the destination. This uses a Service Tag to permit outbound access specifically to Azure SQL resources located in the East US region. Service Tags represent a group of IP address prefixes for a given Azure service, simplifying NSG management. The second correct rule is a deny rule with VNet1's IP address range as the source and Storage as the destination. This uses the Storage Service Tag to block all outbound access to Azure Storage resources from VNet1, fulfilling the requirement to prevent access to any Azure Storage. The option "a deny rule that has a source of VirtualNetwork and a destination of Sql" is incorrect because it would block all SQL access, not just allow specific regional access. The option "a deny rule that has a source of VirtualNetwork and a destination of 168.63.129.0/24" is incorrect because 168.63.129.0/24 is the Azure DNS IP, and blocking it would cause name resolution issues.