Microsoft Azure Administrator Associate AZ-104 Practice Question

Creating a private endpoint for the storage account is the correct solution. A private endpoint assigns the storage account a private IP address within the specified subnet, ensuring that only resources within that subnet can access it, and internet access is blocked. Service endpoints enable access to Azure services over the Azure backbone network but do not disable the public endpoint and cannot restrict access to a single subnet. Configuring a network security group cannot prevent access over the public internet to the storage account's public endpoint. Virtual network peering connects virtual networks but does not provide the required access control.