An application running on a VM in a subnet must access an Azure Storage account. The security team wants the storage account to accept traffic only from that subnet, but they do not want a private IP address in the VNet and they do not want to change DNS records. What should the administrator configure?

Create a private endpoint and a private DNS zone for the storage account.

That would give the service a private IP and require DNS integration, which the requirement explicitly avoids.

Allow access only from the VM public IP address.

That secures by public IP, not by subnet, and it breaks if the VM is replaced or its address changes.

Place the storage account in the same resource group as the VM.

Resource-group placement does not control network access or restrict traffic to a subnet.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet. — A service endpoint is the correct choice when you want to restrict Azure Storage to a subnet without assigning a private IP or changing DNS. The endpoint keeps the storage account on its public address while letting the service recognize traffic from that subnet as trusted network traffic. After enabling the endpoint on the subnet, the storage firewall can be locked down to that VNet or subnet. Why others are wrong: A private endpoint is the opposite of the stated requirement because it creates a private IP and usually requires private DNS. Allowing only the VM public IP is fragile and does not scale to VM replacement or autoscaling. Resource group location has no effect on network reachability, firewall scope, or endpoint behavior.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.