A storage account must be reachable only from resources in a specific Azure subnet, and connections must not use the public endpoint. Which option should the administrator configure?

A service endpoint on the subnet, because it keeps traffic on the Azure backbone.

Service endpoints still use the storage account's public endpoint and do not create a private IP address for the service.

A NAT gateway attached to the subnet.

A NAT gateway changes outbound internet addressing, but it does not provide private access to the storage account.

A storage firewall rule that allows all Azure services.

Allowing all Azure services is broader than the requirement and still uses the public endpoint model.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A private endpoint for the storage account in the subnet. — A private endpoint is the correct solution because it gives the storage account a private IP within the chosen subnet. That means clients in the VNet connect privately, and the public endpoint can be disabled or bypassed entirely for that access path. When the requirement is to limit access to a specific Azure subnet and avoid public networking, private endpoints are the cleanest and most secure design. Why others are wrong: A service endpoint improves access control but still routes to the storage service's public endpoint, so it does not meet the no-public-endpoint requirement. A NAT gateway only affects outbound translation and has nothing to do with private service connectivity. Allowing all Azure services is overly broad and does not restrict access to one subnet.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.