An organization is deploying a new virtual machine (VM) in Azure to host an internal accounting application. The administrator needs to ensure that only authorized incoming traffic on specific ports is allowed to reach the VM, while all other unauthorized inbound network connections are blocked. Which Azure networking component should the administrator configure to filter traffic based on source IP address, port, and protocol?