Microsoft Azure Administrator Associate AZ-104 Practice Question

Creating a private endpoint for the storage account is the correct solution. A private endpoint assigns the storage account a private IP address within the specified subnet, which brings the service into the virtual network. By disabling public network access on the storage account, you ensure it is only accessible via its private IP, which meets the requirement to prevent internet access. A service endpoint secures the connection from a subnet to an Azure service's public endpoint over the Azure backbone network. While you can use firewall rules to restrict access to only the subnet with the service endpoint, the public endpoint itself is not disabled. Configuring a network security group (NSG) controls traffic flow within a virtual network but cannot prevent access to the storage account's public endpoint from the internet. Virtual network peering connects virtual networks to each other and does not directly control access to a storage account.