Microsoft Azure Administrator Associate AZ-104 Practice Question

Creating a private endpoint for the storage account in the virtual network ensures that traffic between resources in the virtual network and the storage account remains on the Azure backbone network. Private endpoints use private IP addresses from your virtual network, effectively bringing the service into your virtual network.

Enabling a service endpoint also allows the virtual network to communicate with the service over the Azure backbone network, but the storage account is still accessible via its public endpoint.

Configuring an ExpressRoute connection provides a private connection between an on-premises network and Azure but is not the primary solution for securing traffic that originates within an Azure virtual network to an Azure service.

Using virtual network peering is for connecting virtual networks to each other; it does not directly provide private access to Azure platform services like Azure Storage.