What does Network Security Groups (NSGs) provide in Azure?

Correct answer: Firewall rules to filter traffic between resources and subnets

Option C correctly identifies the primary function of Azure Network Security Groups: they act as a distributed, stateful firewall by applying inbound and outbound security rules that filter network traffic between Azure resources, subnets, and virtual networks based on source, destination, port, and protocol. Option A is incorrect because API gateway management is handled by Azure API Management, which governs API lifecycle, throttling, and policy enforcement. Option B is wrong because database encryption at rest is configured through Azure Storage Service Encryption or Transparent Data Encryption within the database service itself, not through NSGs. Option D describes identity and access management functions, which are handled by Azure Active Directory and role-based access control, not by NSGs.