A team wants to restrict a storage account so only one Azure subnet can reach it. They do not need a private IP address, and they are fine with the storage account still using its public endpoint. Which configuration should the administrator use?

Create a private endpoint and disable public network access.

A private endpoint would give the service a private IP, which is more restrictive than the requirement and changes how DNS works. The team explicitly does not need a private IP. This option solves a different problem than the one described.

Generate a user delegation SAS token and distribute it only to the subnet.

A SAS token controls access at the application level, not by subnet. It cannot enforce network-based restriction to a specific Azure subnet. This solution would not meet the requirement for network control through the storage firewall.

Change the redundancy setting to ZRS and enable soft delete.

Redundancy and deletion protection do not control which subnet can connect to the account. These settings improve durability or recovery, but they do not restrict network access. The request is specifically about network filtering, not resiliency features.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint on the subnet and allow that subnet in the storage account firewall. — If the team is fine with the public endpoint and only wants subnet-based restriction, a service endpoint plus a storage firewall rule for that subnet is the right fit. Service endpoints keep traffic on the Microsoft backbone and let the storage account identify the subnet as an allowed source. This is simpler than creating a private endpoint when a private IP is not required. Why others are wrong: Private endpoints are more restrictive than needed here and change DNS behavior. SAS tokens are authorization artifacts, not network controls, so they cannot enforce subnet-only access. Redundancy and soft delete affect data resilience and recovery, not inbound network restrictions. The scenario is asking for network filtering, so the subnet/service endpoint approach is correct.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.