Microsoft Azure Administrator Associate AZ-104 Practice Question

Creating a private endpoint for the storage account in the virtual network ensures that traffic between resources in the virtual network and the storage account remains on the Azure backbone network and doesn't traverse the public internet. Private endpoints use private IP addresses from your virtual network, effectively bringing the service into your virtual network.

Enabling a service endpoint (Option A) allows the virtual network to communicate with the service over the Azure backbone network, but the storage account is still accessible over the public endpoint, and some traffic could potentially route through the internet.

Configuring an ExpressRoute connection (Option C) provides a private connection between your on-premises network and Azure but is unnecessary for traffic within Azure virtual networks.

Using virtual network peering (Option D) connects virtual networks, but it doesn't provide private access to Azure platform services like Azure Storage.