Your subscription contains a VM named VM1 that has a single NIC (NIC1) associated with an NSG named NSG1 (default rules present). VM1 runs Windows Server 2022. You need to block access from VM1 to the Azure Instance Metadata Service (IMDS) REST API while minimizing administrative overhead. What should you add to NSG1?

The correct answer is an outbound rule that blocks traffic to a service tag. The Azure Instance Metadata Service (IMDS) uses a well-known, non-routable IP address (169.254.169.254). Azure provides a service tag specifically for IMDS, named AzureInstanceMetadata. By creating an outbound NSG rule that denies traffic to this service tag, you effectively block access to IMDS from VM1 without needing to hardcode IP addresses. An outbound rule blocking traffic to an IP address would work, but using the AzureInstanceMetadata service tag is the recommended approach for minimizing administrative overhead as it abstracts the specific IP address. Inbound rules are irrelevant here because VM1 is initiating the connection to IMDS, meaning it's an outbound flow from VM1's perspective. Application security groups (ASGs) are used to group VMs or NICs and apply NSG rules to them, not to block access to specific Azure services like IMDS.