Exam AZ-700 topic 2 question 47 discussion

The question says 'only hosts on VNET1' -> private endpoint. with service endpoint storage can be accessed access over the internet.

You can also use Service Endpoints: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?toc=%2Fazure%2Fvirtual-network%2Ftoc.json&tabs=azure-portal#grant-access-from-a-virtual-network + You need Service Endpoints Policies: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

1.create storage service endpoint at vnet subnet; 2.from storage account, restrict access from selected vnet (security+networking -> networking)

I think in this case the answer is Private Endpoint because you want to restrict access to that specific storage instance

I asked this to ChatGPT and it selected Private Endpoint. To summarize: With a service endpoint, you are allowing access from any subnet within your VNET or any virtual network that's been granted access. It doesn't restrict to a specific subnet or set of IPs within your VNET. Given your requirement to restrict access to only hosts on VNET1 and to ensure access over the Azure backbone network, a Private Endpoint is the correct choice.

whenever we face a dilemma like this, I would go for the cheaper option, hence Service Endpoint

I would NORMALLY go for Service Endpoint 3 reasons 1- SP enables private IP addresses in Vnet to reach the endpoint if resource/azure service without needing public IP done via Azure backbone network 2- SP allows you to chose all Subnets in Vnet whereas Private Endpoint you are restricted to one Subnet and hence not ALL subnets in Vnet are allowed! 3- You can use SP policy to further restrict access to the Vnet in question ONLY Of course this ONLY effective if you first DISABLED public Access at the networking option of the storage account and once that is done then by default the FW at storage level will BLOCK all traffic unless explicitly allowed via SP or Private endpoint https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

Can i use Storage Account Firewall to permit access only to VNET1?

I got this one today, Service Endpoint would be sufficent as others mentioned. But in my exam I've actually created Private Endpoint into VNET1 as part of previous task (all lab tasks are in one environment.) and also, I had peering from VNET1 to some others as part of different task. So in my case, Service Endpoint won't do it, because other vnets could access the storage via peering and private endpoint. In this setup, it would need intricate setup of NSGs and Private Endpoint policies. At the end, I figured, that MS just didn't think through that combination (as other tasks were quite easy) and I've created Service Enpoint.

Wouldn't you need to use a Service Endpoint as Private Endpoints are applied to a subnet.