Exam AZ-700 topic 2 question 81 discussion

When Service Endpoint policies are applied on a subnet, the Azure Storage Service Endpoint scope gets upgraded from regional to global. This process means that all the traffic to Azure Storage is secured over service endpoint thereafter. The Service endpoint policies are also applicable globally. Any storage accounts that aren't explicitly allowed are denied access. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

D - set a policy to control to what can the VNet have access when using the service point. Ref: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

When you switch the redundancy of a storage account from Locally Redundant Storage (LRS) to Read-Access Geo-Redundant Storage (RA-GRS), the storage account gains a secondary endpoint in the paired region. However, existing service endpoints are tied to the primary region only, and they do not automatically support access to the secondary endpoint in the paired region. D. Create a service endpoint policy: Service endpoint policies are used to restrict which storage accounts can be accessed via a service endpoint, but they do not enable access to paired regions.

My final answer is D. Create a service endpoint policy.

I will go with B! When you enable Read-access geo-redundant storage (RA-GRS) for your storage account, the data is replicated to a secondary region (the paired region) to provide read access in case of a regional outage. However, service endpoints are tied to the original region where they were created and do not automatically update to include access from the paired region

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

To ensure that the contents of your storage account (storage1) will be accessible by using a service endpoint in a paired region with minimal administrative effort, you should: A. Create an object replication rule for storage. This will allow you to replicate the contents of storage1 to another storage account in the paired region, ensuring accessibility through a service endpoint in that region.