During network reconnaissance of an Azure VM, you inspect its Network Security Group. Which inbound rule creates the highest risk?
Allow TCP 443 from Internet
Allow TCP 22 from Internet
Deny all inbound from Internet
Allow TCP 1433 from private subnet only