A storage account should accept requests only from a specific virtual network subnet in Azure. The team does not want traffic to reach the public endpoint from the internet. What should the administrator configure?

Enable anonymous blob access

Anonymous access affects authorization, not network path control, so it would not restrict internet traffic.

Move the container to the Archive tier

Tiering changes storage cost and availability behavior, but it does not limit which networks can connect.

Assign the Contributor role to the subnet

Azure RBAC does not assign roles to a subnet for storage network filtering, so this would not control access path.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Add a storage network rule for the subnet or use a private endpoint — To keep storage traffic off the public internet, you should use storage network rules and, when appropriate, a private endpoint. Network rules let you restrict access to specific virtual networks or subnets, while a private endpoint gives the storage account a private IP in the VNet. That combination provides controlled connectivity and prevents general internet access to the service. Why others are wrong: Anonymous access does not enforce network restrictions and would only weaken security. Archive is unrelated to network access and changes only how blob data is stored and retrieved. RBAC controls permissions, not which subnet can reach the service, so assigning Contributor to a subnet is not a valid Azure control.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.