AZ-900 Practice Question 94: NSG Inbound Filtering

A network security group (NSG) contains security rules that allow or deny inbound or outbound traffic, evaluated by source, destination, port, and protocol, and it attaches to a subnet or a network interface, precisely the two attachment points the stem allows. Adding a rule that allows the partner's IP range on TCP 443 covers the requirement, and NSGs already include a default lowest-priority rule that denies all other inbound traffic, so nothing else needs to be added to satisfy "every other inbound request is dropped."

Option B, a load balancer, distributes incoming traffic across multiple instances using health probes; it has no concept of allowing or denying traffic by source IP or port, so it cannot enforce this restriction. Option C, virtual network peering, connects two Azure virtual networks to each other over the Microsoft backbone; it is not scoped to arbitrary external IP ranges and does nothing to filter traffic once connected. Option D, a private endpoint, maps a private IP to an instance of a PaaS resource such as a storage account; it is not something you attach to virtual machines, and it does not filter traffic by port or source address.

Reference: Azure network security groups overview