Joe would not be able to modify the network firewall rules because those are only available to the cloud provider. Geofencing would restrict the geographic locations from which users may access the servers, which is not Joe’s requirement. Traffic inspection may be used to examine the traffic reaching the instance but is not normally used to create port-based restrictions, making it another incorrect answer. Network security groups however, provide functionality equivalent to network firewalls for cloud-hosted server instances. They allow the restriction of traffic that may reach a server instance, making Network security groups our correct answer.