Which defense-in-depth layer includes Network Security Groups?

Network Security Groups (NSGs) operate at the Network layer of the defense-in-depth model. NSGs filter network traffic to and from Azure resources in a virtual network, allowing or denying communication based on rules you define, such as IP address, port, and protocol. This directly protects network connectivity. The Physical layer deals with securing the data centers themselves. The Data layer focuses on protecting stored data, often through encryption and access controls. The Application layer secures the applications running on top of the infrastructure.