A storage account must be reachable only from workloads in one Azure subnet. The team wants to keep using the storage account's public FQDN, avoid creating a private IP address in the virtual network, and avoid managing private DNS zones. What should the administrator configure?

A private endpoint for the storage account

A private endpoint creates a private IP and usually requires private DNS configuration.

An NSG rule that allows TCP 443 to the storage account

An NSG cannot grant access to a PaaS storage account by itself, because storage authorization is handled separately.

An application security group tied to the storage account

Application security groups are for grouping virtual machines, not for controlling storage account network access.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A service endpoint on the subnet and a storage firewall rule for that subnet — Service endpoints are the right fit when you want to keep the storage account public endpoint, avoid a private IP, and restrict access to a specific subnet. The subnet is identified to the storage service, and the storage firewall can allow only that subnet. This preserves simpler DNS behavior than a private endpoint while still giving strong network restriction. Why others are wrong: A private endpoint would create a private IP and push you into private DNS design, which the question explicitly rules out. An NSG cannot authorize access to the storage service on its own. Application security groups are not used for PaaS storage access control. Service endpoints plus storage firewall rules are the only option that matches every constraint.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.