A storage account must be reachable only from resources in one Azure subnet, and public network access should not be used. Which configuration best meets this requirement?

Enable blob versioning on the storage account

Versioning helps with recovery, but it does not restrict network access to one subnet.

Assign a ReadOnly lock to the storage account

A lock protects against changes or deletion, but it does not control where the storage account can be reached from.

Enable a shared access signature

A SAS controls authorization, but it does not create private network connectivity or block public access.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create a private endpoint for the storage account in the subnet — A private endpoint is the best fit when a storage account should be accessible only from a specific subnet and should not rely on the public endpoint. The private endpoint places the service on a private IP address in the virtual network, which keeps the connection internal. This is the standard design for private access to Azure PaaS services from Azure resources. Why others are wrong: Versioning does not affect network reachability. A ReadOnly lock prevents configuration changes, but it does not restrict traffic paths. A SAS can limit what a caller can do, but it still uses network access to the storage service and does not by itself provide private-only connectivity.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.