Diagnostic settings on an Azure storage account must send logs to a destination storage account that has its firewall set to deny all public network access. The team cannot create a private endpoint, but the destination service is one of the Azure services that can bypass the firewall as a trusted Microsoft service. What should the administrator enable?

A service endpoint on the destination storage account subnet

A service endpoint only helps traffic from an Azure subnet and does not provide the trusted-service bypass described here.

A shared access signature with read permission

A SAS controls authorization, not network reachability, so it cannot overcome the storage firewall restriction.

A private DNS zone linked to the workspace virtual network

DNS changes matter for private endpoints, but the scenario explicitly says a private endpoint cannot be created.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: The Allow trusted Microsoft services to bypass this firewall setting — When a supported Azure service must write to a storage account that blocks public network access, the trusted Microsoft services bypass is the intended exception path. It keeps the firewall closed to general traffic while still allowing the specific service to deliver diagnostics. Since a private endpoint is not allowed and the service is trusted, enabling this option is the minimum configuration that satisfies both security and operational requirements. Why others are wrong: A service endpoint only applies to a subnet and does not solve the trusted-service delivery scenario. A SAS token governs data authorization, not whether the network firewall will accept the connection. Private DNS zones are relevant when private endpoints exist, but the prompt explicitly rules that out. The core issue is firewall reachability, so the trusted-services bypass is the correct control.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.