How Do You Keep VM1-to-Storage1 Traffic Off the Internet?

Why the Answer Is Correct

A private endpoint gives storage1 a private IP address inside the virtual network (or a peered/connected VNet), so the VM resolves the storage account's blob/file/queue/table endpoint to that private IP and the traffic rides the VNet and Microsoft backbone instead of the public internet. That is exactly the requirement: data transfers between storage1 and VM1 must not traverse the internet. Private endpoints are part of Azure Private Link and are the only option listed that changes the network path rather than the authorization or filtering behaviour. Yumperboy's comment captures the doctrine well: a private endpoint uses "a private IP address from your VNet, effectively bringing the service into your VNet". Because the reference answer is B and every recorded vote is B, the answer key, the community and Microsoft's own Private Link guidance all agree here.

Why the Other Options Are Wrong

Data protection (A) is a set of storage features such as soft delete, versioning, and immutable blobs — it governs durability and recoverability of data, not the route packets take, so it has no effect on internet traversal. A shared access signature (D) is a delegated authorization token that grants time-limited access to storage resources; traffic signed with a SAS still travels over the storage account's public endpoint. Public network access in the Firewalls and virtual networks settings (C) can restrict the storage account to selected VNets and IP ranges, but it does not pull the service into the VNet: allowed clients still connect to the public endpoint and the packets still cross the internet path unless a private endpoint or service endpoint is separately configured. Restricting the firewall without a private endpoint therefore fails the 'do NOT traverse the internet' test.

Community Comment Notes

The comment thread is unusually one-sided: as Yumperboy and SkyZeroZx both explain, the private endpoint gives storage1 a private IP from the VNet and keeps VM-to-storage traffic on the virtual network, and "all the traffic from VM1 to storage1 travels across the Microsoft backbone network without going out to the public internet". testtaker09 reports seeing this item in the exam on 17/06/2024, and RajeshwaranM grumbles that it is a "Repeated questions" item — useful signal that this scenario shows up often. Peachu200 simply states the "correct Amswer:B", and Mysystemad and edurakhan confirm B as well. No commenter argues for A, C, or D, so there is no credible competing rationale to weigh against the Private Link reasoning.