An architect needs to design a solution where Azure Storage accounts are accessible only from specific virtual network subnets. Which two features, used together, achieve this?

Question

Microsoft Azure Fundamentals — Hard

An architect needs to design a solution where Azure Storage accounts are accessible only from specific virtual network subnets. Which two features, used together, achieve this?

Accepted Answer

To restrict access to Azure Storage accounts from specific virtual network subnets, VNet Service Endpoints on the subnet and Storage account firewall VNet rules must be used together. This combination ensures that only traffic from the specified subnets can reach the storage accounts.