Microsoft Azure Administrator Associate AZ-104 Practice Question
You have an Azure Storage Account that must be accessible only from a specific subnet in your virtual network. You need to prevent internet access to the storage account and deny access from other subnets. What should you configure to meet these requirements?
Configure a network security group to allow traffic from the subnet to the storage account
Create a private endpoint for the storage account
Create a service endpoint for Azure Storage on the subnet
Implement virtual network peering between the subnet and the storage account
Creating a private endpoint for the storage account is the correct solution. A private endpoint assigns the storage account a private IP address within the specified subnet, ensuring that only resources within that subnet can access it, and internet access is blocked. Service endpoints enable access to Azure services over the Azure backbone network but do not disable the public endpoint and cannot restrict access to a single subnet. Configuring a network security group cannot prevent access over the public internet to the storage account's public endpoint. Virtual network peering connects virtual networks but does not provide the required access control.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a private endpoint in Azure?
Open an interactive chat with Bash
What is the difference between a private endpoint and a service endpoint?
Open an interactive chat with Bash
What are network security groups (NSGs) and how do they work?
Open an interactive chat with Bash
Microsoft Azure Administrator Associate AZ-104
Configure and manage virtual networking
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access