Which Azure service provides a virtual firewall to control inbound and outbound traffic between subnets?

Azure Firewall is a cloud-native, intelligent network firewall security service that provides threat protection for your cloud workloads running in Azure. It offers centralized control over inbound and outbound network traffic between subnets, allowing you to define granular rules for filtering. Azure DDoS Protection provides enhanced DDoS mitigation capabilities but is not a virtual firewall for subnet traffic control. Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications, focusing on Layer 7 (HTTP/HTTPS) routing, not general network firewalling. Network Security Groups (NSGs) also provide traffic filtering at the network interface or subnet level, but Azure Firewall offers more advanced, centralized, and stateful firewall capabilities across multiple virtual networks and subscriptions, making it a more comprehensive virtual firewall solution for controlling traffic between subnets.