The compost-lab storage account must be reachable only at an IP inside the VNet. Which control should the security engineer implement?
Select an answer to reveal the explanation.
Short Explanation
Need a private IP in your subnet for Storage? That’s Private Endpoint—Private Link parks a NIC in the VNet. Service Endpoint still talks to the public VIP.
Full Explanation
A Private Endpoint uses Private Link to map a PaaS resource to a network interface with a private IP in a chosen subnet, so clients reach the compost-lab storage account only at an IP inside the VNet (when public access is appropriately disabled). Implement Private Endpoint for that private-IP requirement.
Enabling only a Microsoft.Storage Service Endpoint and treating the public VIP as the private IP fails by concept. Attaching a Service Endpoint policy without placing any private NIC in the subnet does not create a private IP for the account. Publishing the account through a Public Load Balancer frontend in the hub fails private-only design.
Exam caveat: Private Endpoint = private IP; Service Endpoint = backbone path to public VIP with VNet identity. Operational check: create the Private Endpoint, configure DNS, disable public access as planned, and verify clients resolve and connect to the private IP. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.