A storage account must be reachable from a VNet without ANY exposure to the public internet — traffic needs a private IP on the VNet. Which approach is correct?
A.Service endpoint — extends the VNet to the service's public IP
Service endpoints don't give the service a private IP — the service stays publicly addressed.
B.Private endpoint (Private Link) — injects a private IP into the VNet
Private endpoint = private IP in your VNet. Correct.
C.Public endpoint with a firewall rule
Still a public endpoint — just filtered.
D.NAT gateway for outbound-only access
NAT gateway handles outbound source NAT — unrelated to private service access.
Why this answer
Private endpoint puts the service's private IP inside YOUR VNet — traffic never traverses public space and the service's public endpoint can be disabled entirely. Service endpoints keep the service on public IP (traffic stays on Microsoft backbone but destination remains public-addressed). The private-IP-in-VNet requirement = Private Link.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Virtual Networking practice session.
Practice Virtual Networking