Security Groups

[Michael Phillips]

I posed this question in the user list, but I figured I would throw it out here 
as well...So If I have created a zone with the 
"DefaultSharedNetworkOfferingWithSGService" network offering, then created a VM 
using the default security group, which has 0 ingress rules, I should NOT be 
able to do things like PING that VM correct? The answer to the above question 
was answered "correct"...My next question is, in that case what are some things 
I could look at to see why it's not behaving as expected.