While using NSG to control outbound connectivity, it is recommended to allow a number of different service tags. Which of the following service tag-based NSG rule would you need to create to enable…

The AAD service tag covers Azure Active Directory authentication traffic generally and is not the specific tag required for ADE key retrieval during VM replication.

The EventHub service tag covers Azure Event Hubs traffic and is unrelated to ADE-enabled VM replication requirements.

The AzureSiteRecovery service tag enables general ASR replication traffic but is not the specific tag required to support ADE key vault communication during replication.

Azure Disk Encryption stores disk encryption keys and secrets in Azure Key Vault; during replication of ADE-enabled VMs, Azure Site Recovery must communicate outbound with Key Vault to access those keys, requiring an NSG rule that allows the AzureKeyVault service tag.

The GuestAndHybridManagement service tag covers Azure Automation and guest configuration agent traffic, not ADE Key Vault access.