The correct answer is A: network security groups (NSGs). A network security group functions like a firewall and can be attached to a virtual network, individual subnets, or network interfaces assigned to virtual machines. This allows you to filter network traffic to and from Azure resources, restricting the types of connections between web servers and database servers. Multiple NSGs can be used within a virtual network to manage traffic rules for multiple virtual machines, making it the ideal solution for the given scenario.