An NSG has an inbound deny rule at priority 100 and an allow rule at priority 200 matching the same new TCP connection. What is the result?

1. The connection is denied
2. The connection is allowed because allow always wins
3. The source chooses the rule
4. Both rules are ignored because their actions differ