An administrator wants a storage account to be accessible only from one subnet. The storage account should still use its public FQDN, the team does not want a private IP address in the VNet, and they do not want to manage private DNS zones. Which solution should be used?

Create a private endpoint and disable public network access.

A private endpoint gives the storage service a private IP in the VNet and usually requires private DNS planning. That conflicts with the stated requirement to avoid a private IP and avoid managing private DNS zones.

Peer the subnet to a dedicated storage VNet and route traffic through peering.

VNet peering connects virtual networks to each other. It does not restrict storage account access by itself and does not create the storage-specific access control behavior described here.

Assign a route table with a host route to the storage account.

Route tables are used for IP forwarding decisions, not for controlling Azure Storage authorization or service access. They cannot replace storage firewall rules or service endpoints.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint on the subnet and restrict the storage firewall to that subnet. — A service endpoint is the right choice when the goal is to allow a specific subnet to reach a storage account without creating a private endpoint or managing private DNS. The storage account remains reachable through its public FQDN, but access is restricted to the selected subnet through firewall rules. This matches the requirement precisely and avoids the extra DNS and private-IP work that comes with private endpoints. Why others are wrong: A private endpoint conflicts with the requirement to avoid a private IP and private DNS management. Peering is not a storage access-control mechanism. A route table cannot grant or restrict Storage service access. The requirement is specifically about subnet-restricted access to the public service endpoint, which is the classic use case for a service endpoint.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.