Your company will deploy multiple web servers and multiple database servers to Azure. Which Azure solution should you recommend to restrict the types of connections web servers can make to the database servers?

Network Security Groups (NSGs) are the correct choice because they allow you to filter network traffic to and from Azure resources in an Azure Virtual Network. You can define inbound and outbound security rules that permit or deny traffic based on source IP address, destination IP address, source port, destination port, and protocol. This directly addresses the need to restrict connections between web servers and database servers. Azure Service Bus is a messaging service for connecting applications and devices, not for network traffic filtering. A Local Network Gateway is used to connect an on-premises network to an Azure Virtual Network, not for internal network segmentation. Route filters are used with ExpressRoute to consume a subset of advertised routes, which is unrelated to restricting server-to-server connections within a virtual network.