Microsoft Azure Administrator Associate AZ-104 Practice Question

To meet the requirements, you should create a private endpoint for Storage1 in VNet1. This allows resources in VNet1 to securely access Storage1 over the Azure private network. Private endpoints map a specific instance of a PaaS resource to a private IP address in your virtual network, ensuring that the resource is not accessible from the public internet or other networks.

Enabling service endpoints (Option B) allows resources in VNet1 to access Storage1 over the Azure backbone network but does not restrict access from other virtual networks or the internet. Configuring firewall rules (Option C) to allow VNet1's IP ranges would still expose Storage1 to the internet and requires maintaining IP address ranges. Setting up a VPN gateway (Option D) is unnecessary within Azure and more suited for connecting on-premises networks to Azure virtual networks.