Microsoft Azure Security Engineer Associate AZ-500 Practice Question

A virtual network service endpoint for Microsoft.Storage extends the identity of AppSubnet to the Azure Storage service. After the endpoint is enabled, traffic from the subnet to any storage account in the same region is routed over the Microsoft backbone rather than the public Internet. You can then add the subnet to each storage account's network rules so that connections from other locations are denied. The storage accounts keep their public IP addresses and existing DNS records, so no private IP assignment or custom DNS is required.

Private endpoints would also secure the traffic but would assign private IPs and require Private DNS integration, which the scenario disallows. A NAT gateway provides outbound SNAT only and does not let the storage account distinguish traffic sources. Deploying an Azure Firewall with DNAT rules would not eliminate Internet traversal and would add unnecessary complexity.