A workload in Tenant A must privately access a Storage account in Tenant B. The VNet in Tenant A must resolve the storage endpoint to a private IP and continue enforcing NSGs on workload subnets. What two actions should you perform? Choose two.

To privately access a storage account in a different tenant, a Private Endpoint is essential. Creating a Private Endpoint in Tenant A, referencing the storage account's resource ID in Tenant B, allows the connection to be initiated. The owner of the storage account in Tenant B must then approve this connection to establish the private link. For the workload in Tenant A to resolve the storage endpoint to a private IP address, proper DNS resolution is required. This involves creating and linking a private DNS zone (e.g., privatelink.blob.core.windows.net) to the VNet in Tenant A and ensuring the A record for the Private Endpoint is present. This setup ensures private connectivity and allows NSGs on workload subnets to continue enforcing security policies. Enabling service endpoints would route traffic over the Azure backbone but not provide a private IP within the VNet, and it doesn't support cross-tenant private access. Keeping private endpoint network policies enabled is the default and doesn't directly enable cross-tenant private access or DNS resolution. VNet peering with "Use remote gateways" is for VNet-to-VNet connectivity, not for making a specific PaaS service private across tenants.