A storage account must be accessible only from one virtual network, and the storage service must have a private IP address inside that network. Public network access should be disabled. Which solution should the administrator use?

Add a storage firewall rule that allows the subnet's public IP range

Firewall rules control public access paths and do not place a private IP inside the virtual network.

Configure a service endpoint for the subnet and keep public access enabled

Service endpoints extend identity to the service, but they do not create a private endpoint IP.

Peer the virtual network to the storage account's region

VNet peering connects networks, but it does not provide a private IP for the storage service.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create a private endpoint for the storage account in the virtual network — A private endpoint is the correct solution because it places a private IP address for the storage service into the chosen virtual network. That lets the administrator disable public network access while still allowing traffic to the service over the Azure backbone through the private address. Firewall rules and service endpoints are useful in other scenarios, but they do not meet the requirement for a private IP in the VNet. This is the standard design for tightly restricted storage access. Why others are wrong: Firewall rules still depend on the public endpoint and therefore do not satisfy the private-IP requirement. Service endpoints improve routing security, but the storage account remains publicly addressable. VNet peering is unrelated to giving the storage service an IP address inside the VNet.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.