You have an Azure virtual machine named VM1 that connects to a...

You have an Azure virtual machine named VM1 that connects to a virtual network named VNET1.
A network security group (NSG) named NSG1 allows connections to VM1 from VNET1 only.
You need to add an inbound security rule to NSG1 that meets the following requirements:
Allows Azure Backup to back up VM1
Minimizes the types of allowed inbound traffic
What should you use as the source for the inbound security rule?
 

A.  any IP address

B.  the IP address of VM1

C.  a service tag for Azure Backup

D.  an application security group