Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

A network security group (NSG) lets you create stateful inbound and outbound security rules that filter traffic by source IP address, destination IP address, port, and protocol. You can associate an NSG with a subnet or with individual network interfaces attached to virtual machines, so it is ideal for allowing HTTPS from a specific subnet while denying other inbound traffic. Azure Firewall policies also control traffic, but they require deploying the Azure Firewall service and are typically used for centralized, layer-7 filtering across multiple networks. Azure DDoS Protection focuses on mitigating volumetric attacks and does not provide granular port-based filtering. Azure Bastion offers secure RDP/SSH connectivity to VMs and does not control general inbound application traffic.