A matching NSG deny rule has priority 100 and a matching allow rule has priority 200. Which applies to a new connection?

1. The deny rule
2. Both actions simultaneously
3. The allow rule because allow always wins
4. The most recently edited rule regardless of priority