A VNIC's NSG allows TCP 443, while its subnet security list also has a broader applicable allow rule. What is the key security implication?

1. Security lists apply only to IAM users.
2. The VNIC receives no traffic because both mechanisms are configured.
3. The NSG automatically cancels every broader security-list rule.
4. Effective allowed traffic includes applicable allow rules; a restrictive NSG should not be treated as an overriding deny.