Instance-level allow and deny rules restrict which peers can reach a virtual machine's network interface in a city VPC. Which control matches that description?
Select an answer to reveal the explanation.
Short Explanation
Security groups (or similar instance firewalls) are the bouncer at the VM's NIC—only the peers and ports you allow get in. DNS proofs, cost alerts, and license headers do not filter packets. Pin down who can talk to that interface and on which port.
Full Explanation
Network security groups (or analogous instance firewall rules) filter traffic to a virtual machine’s network interface based on peer identity/CIDR and port. Instance-level allow/deny rules in a city VPC match that control and let operators micro-permit only required conversations to each VM NIC. This is distinct from subnet NACLs and from non-network controls.
DNS TXT records used only for domain ownership proofs do not filter VM traffic. Cost anomaly alerts never evaluate packet flows. Source-code license headers inside repositories are unrelated to runtime network filtering.
Exam caveat: security groups are typically stateful and attached to NICs/instances; default-deny with explicit allows is preferred. Combine with least-privilege IAM and patched images for defense in depth.
Operational check: review NSG/rules on representative VMs, remove 0.0.0.0/0 admin ports, allow only required peers, test app connectivity, and alert on overly permissive rule creations. Spot-check monthly across municipal subscriptions.
Prefer source security-group references over wide CIDR allows when peering municipal tiers, and periodically diff running NSG rules against IaC to catch console hotspot changes that bypass review.