Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Azure Firewall is Microsoft's cloud-native, fully stateful firewall as a service. It lets you create and centrally manage network and application rules that apply across multiple virtual networks, provides automatic high availability, and integrates with Azure Monitor for logging and analytics. Network security groups offer only basic L3/L4 filtering for individual subnets or NICs and lack centralized policy management. Azure DDoS Protection focuses on mitigating volumetric attacks but does not provide granular allow/deny rules. Azure Application Gateway with Web Application Firewall protects HTTP/HTTPS workloads, not general outbound or inbound network traffic across virtual networks. Therefore, Azure Firewall is the correct choice.