A storage account must be reachable only from a single subnet. The team wants to keep the storage public endpoint in place, avoid a private endpoint, and avoid managing any custom DNS records. Which change best meets the requirement?

Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.

An NSG rule does not by itself restrict the storage account to one subnet or control access at the PaaS boundary.

Create a private endpoint and set the storage account to use a private DNS zone.

This would work technically, but it conflicts with the explicit requirement to avoid a private endpoint and custom DNS.

Create a route table that sends storage traffic through an Azure Firewall appliance.

A route table can steer traffic, but it does not replace storage firewall authorization or subnet-based access control.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list. — To keep the public endpoint while restricting access to one subnet, the combination of a service endpoint and a storage firewall rule for that subnet is the right design. The storage account remains public, so no private DNS or private IP is introduced. Yet the service endpoint identifies the subnet as an authorized source, which gives you the access restriction the team wants with minimal operational overhead. Why others are wrong: An NSG cannot enforce storage-account-level access by itself. A private endpoint would meet the security goal but violates the requirement to avoid one. Route tables can influence next-hop behavior, but they do not grant access to the storage service or replace the storage firewall allow list.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.