In Azure, network security groups (NSGs) are most often appliedto subnets, but they can also be applied to the virtual networkinterface cards (NICs) that connect VMs to VNets. If a VM hosting aMySQL database server belongs to a subnet that uses firewall rulesin an NSG to restrict traffic to the subnet, why would anadministrator consider applying an identical NSG to the databaseVM's NIC?

1. To allow VMs in other subnets to connect to the database VMusing a DNS name rather than an IP address
2. To ensure that if another VM in the subnet is compromised, thefirewall rules that protect the subnet also protect the databaseVM
3. To allow VMs in other subnets to connect to the database VMusing an IP address rather than a DNS name
4. To ensure that if another VM in the subnet is compromised, thefirewall rules that protect the subnet also protect VMs in othersubnets