A web app in a subnet must access a storage account through the storage account's public FQDN. Access must be limited to that single subnet, and the team does not want to deploy a private endpoint or manage private DNS records. Which configuration should you use?

Deploy a private endpoint and private DNS zone.

That would require private IPs and DNS management, which the requirement explicitly wants to avoid.

Add a route table that sends storage traffic to an NVA.

Routing traffic through an appliance does not restrict the storage service to one subnet.

Place the storage account behind a public load balancer.

A storage account is not secured this way, and a load balancer does not provide subnet-scoped access control.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint on the subnet and allow that subnet in the storage account network rules. — A service endpoint is the best fit when you want to keep using the storage account's public FQDN but limit access to a specific subnet. It extends the subnet's identity to the Azure Storage service without creating a private IP or requiring private DNS management. After enabling the endpoint, you restrict the storage account's network rules so only the selected subnet can access it. Why others are wrong: A private endpoint would meet the access goal, but it introduces a private IP and DNS configuration that the scenario forbids. A route table does not enforce storage access control. A public load balancer is not a storage security mechanism. Service endpoints are the intended feature when public FQDN access must remain while narrowing access to a subnet.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.