A storage account must remain reachable through its public endpoint for an on-premises integration server, but only one Azure subnet should be allowed to access it from Azure. The team does not want private endpoints or DNS changes. What should the administrator configure?

Add a private endpoint and disable public network access

That would remove public endpoint access for the on-premises server, which violates the requirement.

Create a SAS token restricted to that subnet

SAS tokens control data authorization, but they cannot restrict traffic to a specific subnet.

Assign Storage Blob Data Reader to the subnet

RBAC cannot be assigned to a subnet, and data-plane permissions do not enforce network origin restrictions.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint on the subnet and add that subnet to the storage account networking rules — Service endpoints combined with storage firewall rules are the correct fit when you want to keep the public endpoint available but restrict Azure access to a specific subnet. The service endpoint identifies the subnet, and the firewall rule allows only that subnet to use the account. On-premises traffic can still reach the public endpoint because public network access remains enabled. This makes the solution both secure and compatible with the mixed access pattern. Why others are wrong: A private endpoint would eliminate the public endpoint path the on-premises server still needs. SAS tokens do not enforce network location and therefore cannot meet the subnet-only requirement. RBAC assignments apply to identities, not subnets, so they are the wrong control for network restriction. The key distinction is that the problem is about network origin, not just authorization.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.