A company has a virtual machine in a subnet that must access an Azure Storage account. The storage account should remain reachable through its public endpoint, but access must be limited to that subnet, and the traffic should stay on the Azure backbone rather than the internet. Which feature should the administrator configure on the subnet?

A private endpoint for the storage account.

A private endpoint would give the storage account a private IP and usually changes the access pattern away from the public endpoint.

A site-to-site VPN connection to the storage account.

VPN connects networks, not individual PaaS service access paths, and is unnecessary here.

An application security group assigned to the storage account.

Application security groups are for NICs in NSG rules, not for securing Azure Storage.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A service endpoint for Microsoft.Storage. — A service endpoint is the right choice when you want the storage account to remain on its public endpoint but only accept traffic from a specific subnet over the Azure backbone. It is a common fit for subnet-based access control without introducing a private IP or DNS changes required by a private endpoint. The storage firewall can then allow only that subnet. Why others are wrong: A private endpoint changes the service to a private IP-based access model, which is not what the requirement asks for. A site-to-site VPN is a network connectivity solution, not a storage access control mechanism. Application security groups are not applicable to Azure Storage because they only work within NSG rule definitions for VM network interfaces.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.