Which additional resources should you provision?

You have an Azure virtual network that contains a subnet named Subnet1. Subnet1 contains 50 virtual machines. Twenty-five of the virtual machines are web servers and the other 25 are application servers.

You need to filter traffic the web servers and the application servers by using application security groups.

Which additional resources should you provision?
A . Azure Private Link
B . a network security group (NSG)
C . a user-defined route
D . Azure-firewall

Answer: B

Explanation:

Application security groups enable you to configure network security as a natural extension of an application’s structure, allowing you to group virtual machines and define network security policies based on those groups.

You can filter network traffic inbound to and outbound from a virtual network subnet with a network security group.

Reference: https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic