A team has Windows VMs in a subnet that need to access an Azure Storage account. The storage account should remain reachable through its public endpoint, but only traffic from that one subnet should be allowed. Which configuration best meets the requirement?

Create a private endpoint and disable public network access on the storage account.

This changes the access model to private IP access instead of keeping the public endpoint available.

Place the subnet behind a NAT gateway and use a shared public IP.

A NAT gateway controls outbound internet translation, not authorization to a storage account.

Add a VPN gateway and route storage traffic through the branch office.

A VPN gateway is for hybrid connectivity and does not by itself restrict storage access to one subnet.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Enable a service endpoint on the subnet and add a virtual network rule for that subnet on the storage account firewall. — This is the classic service endpoint use case. The storage account can keep its public endpoint, but the administrator wants only one Azure subnet to reach it. By enabling the service endpoint on that subnet and adding a VNet rule in the storage firewall, Azure recognizes traffic from that subnet and allows it while denying other sources. No private IP is created, and the service remains public in the Azure sense. Why others are wrong: A private endpoint would replace the public access pattern with a private IP, which the requirement explicitly does not want. A NAT gateway changes outbound source addresses for internet traffic, but it does not authorize access to Storage. A VPN gateway is unrelated unless the source were on-premises. The required control is the storage firewall plus service endpoint combination.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.