A storage account must be reachable only from resources in a single VNet. The team wants the storage service to use a private IP address inside that VNet and wants to disable public network access. Which feature should be configured?

A service endpoint

Service endpoints keep the service on its public endpoint and do not assign a private IP.

A network security group rule on the subnet

An NSG controls traffic to resources in the subnet, not the storage service itself.

A storage account firewall IP allow rule

IP rules restrict public access but do not create a private IP in the VNet.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A private endpoint — A private endpoint is the correct solution when the storage service must be assigned a private IP address inside a specific VNet and public network access must be disabled. It places the storage resource behind a private address in your network boundary and is the standard pattern for private access to PaaS storage services. Service endpoints and firewall rules do not provide that same private IP mapping. Why others are wrong: A service endpoint still reaches the storage account through its public endpoint. An NSG can restrict subnet traffic, but it does not give the storage account a private address. Firewall IP allow rules can limit public exposure, but they do not meet the requirement for private IP-based access inside the VNet.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.