An application runs on an Azure VM in a subnet and must access a storage account over the public endpoint without using a private IP address. The administrator wants to restrict access so only that subnet can reach the account. What should be configured?

Create a private endpoint for the storage account and disable the public endpoint.

A private endpoint would give the storage account a private IP in the VNet, which the requirement explicitly does not want.

Allow trusted Microsoft services to bypass the firewall.

Trusted services bypass is for selected Microsoft services, not for limiting access to one customer-managed subnet.

Add a user-defined route that points storage traffic to the virtual network gateway.

Routes affect where packets go, but they do not grant storage authorization or replace storage firewall rules.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules. — A service endpoint plus a storage account firewall rule is the right design when the storage account should remain on its public endpoint but only one subnet should be allowed. The service endpoint identifies the subnet as trusted, and the firewall rule restricts access accordingly. This approach does not create a private IP and avoids the DNS changes that private endpoints require. Why others are wrong: A uses a private endpoint, which is explicitly excluded by the requirement. C is unrelated because it broadens access to selected Microsoft services rather than a specific subnet. D changes routing but cannot enforce storage account network access policy by itself.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.