Azure Virtual Network Manager security admin configurations provide centrally managed security admin rules across virtual networks in a network group. Because all virtual networks are already managed through Group1 and the requirement is to block inbound RDP from the internet with minimum effort, a security admin configuration is the correct centralized control. A separate NSG could work locally, but it would require distributed management. Connectivity configurations and UDRs do not directly deny TCP 3389. Microsoft platform security questions usually hinge on where enforcement occurs: at the resource, server, subnet, firewall policy, private endpoint, or subscription level. The selected answer uses the control plane that owns that enforcement point. Other options are rejected when they only log activity, broaden network access, or protect a different service category. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Virtual Network Manager; Microsoft Learn > Security admin rules.

==============================================================