Question

Your company deploys an Azure Storage account and creates a private endpoint for its blob service inside a virtual network named VNet1. On-premises and Azure VMs connected to VNet1 must connect to the storage account using its private IP address instead of its public endpoint. After creating the private endpoint, VMs in VNet1 still resolve the storage account FQDN to its public IP address. What should you configure to ensure the FQDN resolves to the private IP?

Accepted Answer

Create a Private DNS zone named privatelink.blob.core.windows.net, link it to VNet1, and enable the private endpoint's DNS integration

Answer

Add a network security group rule on the private endpoint subnet to deny outbound access to the storage public IP

Answer

Enable a service endpoint for Microsoft.Storage on the subnet that contains the VMs

Answer

Create a user-defined route that forces storage traffic through an Azure Firewall