Network Security Group
Problem
Your cloud subnet contains application servers.
Only the web tier should reach them on port 443.
You need traffic rules close to cloud resources.
Solution — NSG / Security Group
Apply network allow/deny rules to interfaces or subnets.
Web subnet → App:443 ✓ Internet → App:443 ✗
Core idea: cloud security groups provide distributed network access control around workloads.