Microsoft Azure Administrator Associate AZ-104 Practice Question

Configuring a private endpoint for 'securedata' in 'corp-vnet' creates a secure connection to the storage account using a private IP address within your VNet. This ensures that the storage account is accessible only within 'corp-vnet' and not over the internet. Option B, configuring the storage account's firewall to allow access from 'corp-vnet', still exposes the storage account's public endpoint to the internet. Option C, implementing a service endpoint for Azure Storage in 'corp-vnet', allows resources in the VNet to access the storage account over the Azure backbone network but does not prevent internet access to the storage account. Option D, generating a shared access signature (SAS) with network restrictions, restricts access at the token level but does not prevent the storage account from being accessible over the internet. Therefore, creating a private endpoint is the appropriate solution to meet the requirements.