Explanation: Q1: No { and it should not be allowed as only TCP 80 is allowed from the "Internet" service tag Q2: Yes {as it should be for VMs in the same local subnet pinging each other on private IP and no NSG configured} Q3: Yes {VM5 is in subnet where 1st rule of NSG allows any traffic from any source to the destination}