Exam AZ-700 topic 5 question 28 discussion

D is correct

C - a service endpoint provides least admin effort, but is less secure. D - a private endpoint provides proper security, by using private IPs everywhere, but they require more admin effort to setup. This is what you should see in commercial products worth their salt, where security is not sacrificed because of the extra initial overhead.

Private endpoint is correct

According to the following link, Server Endpoint can't be used to access Azure services from on-prem networks: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview#limitations:~:text=Endpoints%20are%20enabled%20on%20subnets%20configured%20in%20Azure%20virtual%20networks.%20Endpoints%20can%27t%20be%20used%20for%20traffic%20from%20your%20on%2Dpremises%20services%20to%20Azure%20services.%20For%20more%20information%2C%20see%20Secure%20Azure%20service%20access%20from%20on%2Dpremises

I will go for service endpoint Servers in Site1 can already access VNet1 via the S2S VPN. Service endpoints will allow secure access to storage1 over this connection. Private endpoint requires additional IP management, DNS configuration, higher costs. This complexity isn’t necessary when the VPN is already in place.

To enable servers in your on-premises network (Site1) to connect to your Azure storage account (storage1) via the Site-to-Site (S2S) VPN with minimal administrative effort, you should create a private endpoint for the storage account in your virtual network (VNet1). Security: The connection is private and does not traverse the public internet. Simplicity: Once set up, it requires minimal ongoing management. This setup will allow your servers in Site1 to access storage1 securely and efficiently.

C is correct. Private endpoint is specific to one storage account. service endpoint requires less administrative effort

D correct

Selected Answer: B

Given Answer is Correct D

Correct.