You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual netwo...

You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1.
You need to prevent VM1 from accessing VM2 on port 3389.
What should you do?

A. Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1. B. Configure Azure Bastion in VNet1. C. Create a network security group (NSG) that has an outbound security rule to deny source port 3389 and apply the NSG to Subnet1. D. Create a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply the NSG to Subnet1.