You plan to deploy several Azure virtual machines and must control which Internet ports can be used to access them. Which service should you use?

A network security group (NSG) is the correct choice because it acts as a virtual firewall for your virtual machines, controlling inbound and outbound traffic based on rules you define. These rules specify source and destination IP addresses, ports, and protocols, allowing you to precisely manage which internet ports can be used to access your VMs. Azure Active Directory (Azure AD) roles and groups are used for identity and access management, defining who can perform actions within Azure, not for controlling network traffic to VMs. Azure Key Vault is used for securely storing and managing cryptographic keys, secrets, and certificates, which is unrelated to network port access.