A storage account must remain on its public endpoint, but only one Azure subnet named AppSubnet should be allowed to access it from Azure. No private IP is required. Which two actions should the administrator take? Select two.

Create a private endpoint and disable public network access.

That would switch the account to private IP access, which is specifically not required here.

Link a private DNS zone to AppSubnet.

Private DNS is only needed when clients must resolve the service to a private endpoint address.

Assign the Reader RBAC role to AppSubnet.

Subnets do not receive RBAC roles, and Reader does not control network path access to storage.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Enable the Microsoft.Storage service endpoint on AppSubnet. — When a storage account must stay on its public endpoint but only one subnet may access it, the correct pattern is a service endpoint plus a storage firewall rule scoped to that subnet. The service endpoint identifies the subnet as the source, and the firewall permits only that selected virtual network/subnet combination. This blocks other Azure subnets while avoiding the complexity of a private endpoint. Why others are wrong: A private endpoint would change the solution to private IP access, which the requirement explicitly excludes. Private DNS is unnecessary without a private endpoint. RBAC does not control network access from a subnet to storage; it only governs authorization after the request reaches the service.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.