Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Azure Firewall includes a built-in threat intelligence-based filtering capability. When enabled, the service automatically denies or alerts on traffic to and from IP addresses and domain names that Microsoft identifies as malicious, so administrators do not need to maintain their own block lists. Network security groups provide only static allow/deny rules and have no built-in threat-intelligence feeds. Azure DDoS Protection focuses on volumetric attacks and does not inspect outbound connections or apply reputation filtering. Azure Bastion offers secure RDP/SSH connectivity to virtual machines but does not filter general network traffic.