Microsoft Azure Administrator Associate AZ-104 Practice Question

Create a private endpoint for Storage1 in a subnet of VNet1 and set Storage1's Public network access setting to Disabled. The private endpoint allocates a private IP address from VNet1 so traffic stays on the Azure backbone, and disabling the public endpoint removes every other possible path to the storage service.

Enabling service endpoints alone still exposes the storage account's public endpoint unless you also add and maintain explicit virtual-network rules. Firewall rules based on IP ranges do not guarantee isolation because the public endpoint remains reachable and Azure-assigned addresses can change. A VPN gateway is intended for cross-premises connectivity, not for securing traffic within Azure.