An application runs in a subnet and must reach a storage account over the public endpoint, but only that subnet should be allowed. The team does not want to use a private endpoint. Which two configurations should the administrator use? Select two.

Create a private endpoint for the storage account.

A private endpoint gives the service a private IP address, which the scenario explicitly says not to use.

Assign the Reader role to the subnet.

Subnets do not receive Azure RBAC roles. Reader would not control storage network access anyway.

Turn on blob soft delete.

Soft delete helps recovery of deleted blobs, but it does not restrict which networks can reach the storage account.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Enable the Microsoft.Storage service endpoint on the subnet. — When the team wants public-endpoint access limited to one subnet without a private endpoint, the usual design is a service endpoint plus a storage account virtual network rule. The service endpoint lets Azure recognize the subnet as coming from the VNet, and the firewall rule then allows only that subnet. This keeps access controlled while still using the public endpoint. Why others are wrong: A private endpoint changes the design to private IP access, which the question excludes. RBAC roles do not apply to subnets as network controls, and blob soft delete is unrelated to connectivity. These distractors mix storage features with network authorization, but only service endpoints and virtual network rules solve this access pattern.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.