Microsoft Azure Administrator Associate AZ-104 Practice Question

To allow access only from specific internet-based clients, you should configure the storage account's firewall settings to permit those clients. The firewall allows you to specify which public network locations (such as IP addresses) are allowed to access the storage account. Network Security Groups (NSGs) are used to control traffic at the subnet or network interface level within Azure Virtual Networks and cannot be applied directly to storage accounts. Azure DDoS Protection helps mitigate distributed denial-of-service attacks but does not restrict access to specific clients. Virtual Network Service Endpoints secure access to storage accounts from within Azure Virtual Networks, not from external clients on the internet.