Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Azure Firewall supports both application-level rules that allow or deny traffic to specific fully qualified domain names and a built-in threat-intelligence-based filtering feature that blocks traffic to known malicious IP addresses or domains. A network security group can filter traffic only by IP address, port, and protocol; it cannot use FQDNs or threat-intelligence feeds. Azure DDoS Protection defends against volumetric attacks but does not provide per-destination filtering. Azure Bastion supplies secure RDP/SSH access to virtual machines and does not control general outbound internet traffic. Therefore, Azure Firewall is the correct choice.