adding screenshot

Author: Blackmist

articles/machine-learning/how-to-secure-training-vnet.md

@@ -68,15 +68,25 @@ To use either a [managed Azure Machine Learning __compute target__](concept-comp
 > * Virtual network service endpoint policies do not work for compute cluster/instance system storage accounts
 > * If storage and compute instance are in different regions you might see intermittent timeouts
 
-    
-> [!TIP]
-> The Machine Learning compute instance or cluster automatically allocates additional networking resources __in the resource group that contains the virtual network__. For each compute instance or cluster, the service allocates the following resources:
-> 
-> * One network security group
-> * One public IP address. If you have Azure policy prohibiting Public IP creation then deployment of cluster/instances will fail
-> * One load balancer
-> 
-> In the case of clusters these resources are deleted (and recreated) every time the cluster scales down to 0 nodes, however for an instance the resources are held onto till the instance is completely deleted (stopping does not remove the resources). 
+### Dynamically allocated resources
+
+The Machine Learning compute instance or cluster automatically allocates additional networking resources __in the resource group that contains the virtual network__. For each compute instance or cluster, the service allocates the following resources:
+
+* One network security group (NSG). This NSG contains the following rules, which are specific to compute cluster and compute instance:
+
+    * Allow inbound TCP traffic on ports 29876-29877 from the `BatchNodeManagement` service tag.
+    * Allow inbound TCP traffic on port 44224 from the `AzureMachineLearning` service tag.
+
+    The following is a screenshot of the default rules for this NSG:
+
+    :::image type="content" source="./media/how-to-secure-training-vnet/compute-instance-cluster-network-security-group.png" alt-text="Screenshot of NSG":::
+
+* One public IP address. If you have Azure policy prohibiting Public IP creation then deployment of cluster/instances will fail
+* One load balancer
+
+In the case of clusters these resources are deleted (and recreated) every time the cluster scales down to 0 nodes, however for an instance the resources are held onto till the instance is completely deleted (stopping does not remove the resources). 
+
+> [!IMPORTANT]
 > These resources are limited by the subscription's [resource quotas](../azure-resource-manager/management/azure-subscription-service-limits.md). If the virtual network resource group is locked then deletion of compute cluster/instance will fail. Load balancer cannot be deleted until the compute cluster/instance is deleted. Also please ensure there is no Azure policy which prohibits creation of network security groups.
 
 ### Create a compute cluster in a virtual network