An application in AppSubnet must access an Azure Storage account over the public endpoint, but only traffic from that subnet should be allowed, and the traffic should stay on the Microsoft backbone. The administrator does not want to create a private IP for the service. Which two actions should be taken? Select two.

Create a private endpoint in AppSubnet.

A private endpoint would create a private IP, which the scenario explicitly says the administrator does not want.

Disable public network access on the storage account.

Disabling public network access would block the public endpoint instead of allowing controlled public-endpoint access.

Assign a public IP address to the storage account.

A public IP cannot be assigned to a storage account; it is a managed platform service, not a VM.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint for Microsoft.Storage on AppSubnet. — This scenario is the classic service-endpoint pattern. The subnet needs to be recognized by Azure Storage without introducing a private endpoint, so a Microsoft.Storage service endpoint on AppSubnet is required. Then the storage firewall must allow that subnet. Together, those settings keep traffic on the Microsoft backbone while preserving access through the public endpoint, exactly as requested. Why others are wrong: A private endpoint would create a private IP, which the requirement explicitly rejects. Disabling public network access would also block the public endpoint. A storage account cannot receive a public IP assignment like a virtual machine, so that option is not valid.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.