An NSG permits a narrow ingress range, but a subnet security list also permits a broader range. What should the reviewer recognize?

1. Having both mechanisms disables every connection automatically.
2. The narrow NSG always cancels all security-list permissions.
3. Applicable allow rules can broaden effective access; the NSG is not a blanket overriding deny.
4. Security lists affect only IAM group membership.