A storage account used for public open-data downloads is reachable on the public internet. What does that reachability indicate about the endpoint type?
Select an answer to reveal the explanation.
Short Explanation
If the world can hit it on the public internet, that is a public endpoint story — a public doorway. Private endpoints keep the doorway inside your VNet. Do not rename storage as ExpressRoute just because it is online.
Full Explanation
A storage account reachable on the public internet is using a public endpoint pattern: the service is addressable via a public IP or internet-facing hostname path, which fits public open-data downloads that citizens and partners retrieve without being on the city’s VNet. A private endpoint, by definition, places a private IP for the service inside a Virtual Network and is the opposite of open internet reachability. Internet reachability does not transform a storage account into an ExpressRoute circuit; ExpressRoute is dedicated connectivity, not a storage endpoint type. Reachable accounts have not “disabled all endpoints” in favor of Policy alone—Policy governs configuration compliance, and it is not the data-plane endpoint citizens use. Understanding endpoint type prevents accidental exposure of non-public datasets. Exam caveat: public endpoint does not mean anonymous or unauthenticated by default—you still apply keys, SAS, identity, and firewall rules; public reachability is about network path, not automatic open ACLs. Operational check: from an internet-connected client outside the city VNet, resolve and access the open-data container with the intended auth method, and review storage firewall exceptions so only approved public scenarios remain exposed.