You plan to design a solution that will use Azure Bastion to provide access from an on$-$premises environment to Azure virtual machines that run Linux.

You need to ensure that connectivity to the virtual machines is only allowed via Azure Bastion.

What should you use?

Select only one answer.

a network security group $($NSG$)$

a VMAccess extension

a web application firewall $($WAF$)$

an application security group