Exam AZ-700 topic 2 question 75 discussion

1) NO the only accessible storage is storage85347 because once the service endpoint policy is assigned it allows ONLY the resources listed in the policy, look here: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies?tabs=portal#apply-policy-to-allow-access-to-valid-storage-account "Ensure that all the resources accessed from the subnet are added to the policy definition before associating the policy to the given subnet. Once the policy is associated, only access to the allow listed resources will be allowed over service endpoints. 2) YES, you can assign the policy to multiple subnets as long as you enable the microsoft.storage service endpoint in advance for all of them. (tested in lab) 3) YES, of course for the same reason mentioned above, the policy (once applied) can restrict the access to the resources add into the policy list only. so to me, is NO, YES, YES

1. No 2. Yes 3. No Policy1 is a service endpoint policy configured for Microsoft.Storage, which controls access to Azure Storage accounts only. • DB1 is an Azure SQL Database, and access to Azure SQL resources is governed by firewall rules or network security rules, not by service endpoint policies created for Microsoft.Storage.