Microsoft Azure Administrator Associate AZ-104 Practice Question

To ensure the storage account is accessible only via a private IP address within the virtual network, the administrator should set up a private endpoint for the storage account. A private endpoint assigns a network interface with a private IP in the virtual network to the storage service, enabling secure, private connectivity. Enabling service endpoints extends the virtual network identity to the storage account but still uses the public IP address of the service. Shared Access Signatures with network restrictions limit resource access but do not prevent public network exposure. Applying a Network Security Group controls traffic at the subnet level but cannot restrict access to the storage account over the public internet.