A team wants to allow a subnet to access a storage account only from that subnet, but they do not want to create a private endpoint or change DNS. The storage account should still be reachable through its public endpoint, just not from other networks. What should the administrator configure?

A private endpoint for the storage account and a private DNS zone.

This changes access to a private IP and introduces DNS work that the team wants to avoid.

A public IP address for the subnet and a storage account firewall exception.

Subnets do not use public IPs for access control in this scenario.

An NSG rule that permits outbound TCP 443 to the storage account.

NSGs allow traffic but do not restrict storage access at the service boundary.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A service endpoint on the subnet and a storage firewall rule allowing that subnet. — A service endpoint is the right fit when the organization wants to keep using the storage account’s public endpoint while restricting access to a specific VNet subnet. The service endpoint extends the subnet identity to the storage service, and the storage firewall can then allow only that subnet. This avoids private DNS changes and keeps the connectivity model simpler than a private endpoint. Why others are wrong: A private endpoint would meet the security goal but violates the stated no-DNS-change requirement. A public IP for the subnet is not how Azure grants service access. An NSG rule can permit outbound traffic, but the storage firewall still needs subnet-based authorization. The question is about retaining the public endpoint while restricting who can reach it, which is the service endpoint model.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.