A storage account must be reachable only from resources in one Azure subnet, and traffic must use a private IP rather than the public endpoint. Which configuration should the administrator implement?

A service endpoint on the subnet

Service endpoints still use the storage account's public endpoint, so the traffic is not private IP based.

A shared access signature scoped to the subnet

A SAS controls authorization only; it cannot restrict access to a subnet by itself.

Allow trusted Microsoft services on the storage firewall

This opens access to many Microsoft services and does not limit access to one specific subnet.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A private endpoint in the subnet — A private endpoint is the correct configuration because it assigns the storage service a private IP address inside the chosen subnet. Traffic stays on the private network path, which satisfies the requirement to avoid the public endpoint. This is the strongest option when the business wants storage access limited to a specific network location. Service endpoints, SAS tokens, and firewall exceptions do not provide the same private-IP access model. Why others are wrong: A service endpoint extends VNet identity to the service, but traffic still goes to the public endpoint. A SAS token only authorizes requests and does not control which subnet can reach the service. Allowing trusted Microsoft services is a broad exception that does not meet the requirement for one subnet only.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.