Microsoft Azure Administrator Associate AZ-104 Practice Question

To ensure that storage1 accepts connections from Subnet1 and rejects connections from other networks, you should enable virtual network service endpoints for Azure Storage on Subnet1 and configure the storage account's firewall to allow access from that subnet. Service endpoints extend your virtual network's identity to Azure services, enabling you to restrict access to specific subnets. Configuring a service endpoint policy manages outbound traffic from your virtual network but does not restrict inbound access to the storage account. Creating a user-defined route does not control access to storage1. Associating an NSG with Subnet1 cannot restrict access to Azure Storage services because NSGs cannot filter traffic to PaaS services over the Azure backbone network.