Tailwind Traders plans secure connectivity from application servers in a VNet to an Azure SQL Database. The security team is comparing Service Endpoints and Private Endpoints. Which statement accurately describes a key security and routing difference?

A private endpoint creates a network interface (NIC) with a private IP address within your VNet, making the PaaS resource (like Azure SQL) appear as if it's directly in your VNet. This provides true network isolation. A service endpoint, conversely, does not assign a private IP to the PaaS resource. Instead, it extends your VNet's identity to the Azure service over the Microsoft backbone, allowing you to configure service-level firewall rules to restrict access to specific subnets. The traffic still flows over the public IP space of the service, but it's routed directly over the optimized Microsoft backbone rather than the public internet.