A storage account must be reachable only from Azure VMs in a single subnet. Public network access should not be used, and the team wants the storage service to keep using a private IP address inside the virtual network. Which feature should the administrator configure?

A service endpoint on the subnet, because it creates a private IP address for the storage account.

Service endpoints improve secure routing to the service, but they do not give the storage account a private IP address in the VNet.

A shared access signature that is limited to the subnet.

A SAS controls authorization, not network path or IP addressing. It cannot make the storage account use a private address in the subnet.

Storage account access keys, because they bind access to one subnet automatically.

Access keys authenticate requests but do not restrict traffic to a subnet or alter the network path to private versus public endpoints.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A private endpoint for the storage account in the subnet. — A private endpoint is the correct configuration because it exposes the storage service through a private IP address in the VNet. That satisfies both requirements: the account is reachable only from the intended network path, and public access is not used. In Azure administration, this is the standard pattern when the business wants the storage service to remain private at the network layer. Why others are wrong: A service endpoint keeps traffic on the Azure backbone and can restrict access by virtual network, but it does not assign a private IP to the storage account. A SAS is only an authorization token, not a network control. Access keys authenticate requests but do not provide subnet-level network isolation.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.