A team wants an Azure Storage account to be reachable only from one subnet, but they do not want to use a private endpoint. Which two configurations should they use? Select two.

Create a private endpoint and leave the firewall open to all networks so the subnet can be filtered later.

A private endpoint is a different design and the firewall should not be left open when restriction is required.

Assign Contributor on the storage account to the subnet, because Azure roles control which networks can connect.

RBAC controls actions, not network reachability to the storage endpoint.

Disable the public endpoint and rely on Internet routing, because that is the only way to limit access to one subnet.

Internet routing would not restrict access to one subnet and would not meet the security requirement.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a Microsoft.Storage service endpoint on the subnet so the subnet can reach the storage service privately over the Azure backbone. — To allow only one subnet without using a private endpoint, you need both sides of the configuration. The subnet must have the appropriate service endpoint enabled so it can present itself to Azure Storage through the Azure backbone. Then the storage account firewall must allow that subnet in its virtual network rules. Together, these settings restrict access while keeping the storage account on its public endpoint. Why others are wrong: A private endpoint is a different solution and was explicitly excluded. RBAC does not control whether a network path is allowed, so assigning a role will not solve connectivity. Simply disabling the public endpoint and using Internet routing would not create subnet-only access and would break the intended design.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.