Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Network security groups (NSGs) provide stateful packet filtering based on source and destination IP address, port, and protocol. They can be associated with individual subnets or individual network interfaces, making them ideal for controlling inbound and outbound traffic to specific workloads. Azure DDoS Protection focuses on large-scale volumetric attacks but does not let you author custom port and protocol rules. Azure Firewall offers centralized, stateful filtering at the virtual-network perimeter, not directly on subnets or NICs. Web Application Firewall protects HTTP/S traffic at the application layer but cannot create general network-level allow/deny rules for other protocols.