Microsoft Azure Administrator Associate AZ-104 Practice Question

To meet the requirements, you should configure a service endpoint for Azure Storage on VNet1 and add a virtual network rule on StorageAccount1. Service endpoints extend your virtual network private address space to Azure services over Azure's backbone network, ensuring that traffic does not go over the public internet. By adding a virtual network rule to StorageAccount1, you restrict access so that only resources in VNet1 can access it. The other options do not fully meet the requirements: creating a NAT gateway does not provide secure connectivity to Azure services; implementing ExpressRoute is unnecessary since both resources are within Azure; setting up a public endpoint with firewall rules still exposes the storage account over the internet.