A company is planning to deploy a web server and database server, as shown in the architecture diagram below. You have to ensure that traffic restrictions are in place so that the database server can only communicate with the web server. 

Which of the following would you recommend for implementing these restrictions?

Answer options:

A.Network Security Groups (NSGs)
B.Azure Service Bus
C.A Local Network Gateway
D.A Virtual Private Gateway

Answer – A 
It would help if you used network security groups to allow or deny traffic within subnets. 
Below is what the Microsoft documentation mentions in terms of filtering network traffic. 

Option B is incorrect since this is used as a messaging system.
Option C is incorrect since this is used to represent a VPN device in a Site-to-Site VPN connection.
Option D is incorrect since this is normally used to connect networks via the Internet.
Remember, Network Security Group (NSG) and Application Security Group (ASG) are two different things. Please visit the below URL to know about ASG- 

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm