A VM's subnet NSG allows inbound HTTPS, but its network-interface NSG denies that traffic. What is required for a new inbound HTTPS connection to succeed through both layers?

1. The subnet allow automatically overrides the NIC deny
2. Only the NIC's resource tag must change
3. Both applicable NSGs must allow the traffic
4. The VM must use a larger disk