In a scenario where you are responsible for securing a critical application hosted on Azure virtual machines, you need to ensure that these VMs are accessible only from specific internal subnets within your organization's Azure Virtual Network. Additionally, the solution must be cost-effective and easily scalable to accommodate future growth. Considering these requirements, which Azure networking feature would you use to restrict access to these VMs, and why? (Choose two options if applicable.)