問題文
A company uses service endpoints to restrict a storage account to specific subnets. A review raises the concern that a user could still copy data to a storage account in another subscription. Which statement is correct?
選択肢
- Service endpoints restrict which subnets may reach the service and also prevent access to any storage account outside the subscription, because the endpoint is scoped to the subscription. No additional service endpoint policy or private connectivity is required for that outcome.
- A plain service endpoint restricts which subnets may reach the service but does not limit which instances of the service can be reached, so an additional control such as a service endpoint policy or private connectivity is needed.
- Adding a network security group rule that allows only the Storage service tag prevents reaching a storage account in another subscription, because the tag resolves to the approved instances.
- The concern is unfounded because service endpoints keep traffic on the Microsoft backbone.