AZ-104 Question 229
Single answerYou are an Azure Administrator for an online retail company. The company’s Azure environment includes a virtual network named VNET1 that hosts an application requiring secure communication with an Azure Storage account. You need to ensure that requests from the application to the storage account use only private IP addresses and do not traverse the public Internet. Which of the following actions must you perform to meet these requirements?
- A
Set up a private endpoint in the same region as the storage account, placed in a subnet within VNET1.
- B
Enable the public endpoint and limit inbound traffic using the storage account firewall.
- C
Enable service endpoints for the storage account and allow traffic from VNET1.
- D
Configure a user-defined route that sends traffic to the public IP of the storage account.
Show answer and explanation
Correct answer: A
Explanation
Private endpoints assign a private IP from the chosen subnet and ensure that traffic to the PaaS resource remains within the Azure private network. This prevents data from traversing the public Internet and provides a higher level of security.
- A. Correct.
Creating a private endpoint in the same region and subnet as your VNet ensures traffic remains on the internal Azure backbone and is never exposed to the public Internet.
- B. Incorrect.
Simply using the public endpoint with firewall rules does not guarantee traffic will stay fully private; it still goes over a public connection before the firewall restricts access.
- C. Incorrect.
Service endpoints provide a secured channel over the public network backbone but do not fully privatize traffic as private endpoints do.
- D. Incorrect.
User-defined routes controlling traffic flow will not provide a private IP address for the storage account; the traffic would still go to a public endpoint.