A network security group allows a VM to initiate an outbound connection. Must an explicit inbound rule separately allow the corresponding response flow?

1. No inbound traffic can ever return through an NSG
2. No; NSGs are stateful for allowed established flows
3. Yes; NSGs are entirely stateless
4. Only when the VM has a premium disk