A team wants one subnet to access an existing Storage account over its public endpoint. They do not want a private IP for the account or any DNS changes, but they want to block access from all other subnets. What should the administrator configure?

Create a private endpoint and disable public network access on the storage account.

A private endpoint changes the network model and typically requires private DNS integration.

Assign the Storage Blob Data Reader role to the subnet.

RBAC controls authorization, not subnet-based network access to the storage account.

Associate a route table with a default route to the storage account private IP.

Storage accounts do not use a customer-defined private IP on the public endpoint path.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint on the subnet and add a virtual network rule on the storage account. — This requirement matches a service endpoint design. The storage account can continue using its public endpoint, but the administrator can allow only the selected subnet by enabling the Microsoft.Storage service endpoint on that subnet and adding the corresponding virtual network rule on the storage account. No private IP or DNS change is required, which aligns with the business constraint. Why others are wrong: A private endpoint would change the access pattern and usually requires private DNS. RBAC roles do not restrict network paths, so they cannot block other subnets. A route table cannot direct traffic to a storage account as if it had a customer-defined private IP for the public endpoint.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.