When planning IP addressing for Azure virtual network subnets, which of the following resource types requires assigning IP addresses within the subnets?

Private endpoints require IP addresses from within a subnet because they establish a private connection to an Azure service, making that service appear as if it's part of your virtual network. This direct, private access necessitates an IP address from the subnet's range. Azure DDoS Protection, Virtual Network NAT, and service endpoint policies are network features or configurations that operate on or with subnets but do not consume IP addresses from the subnet themselves. DDoS Protection is a service applied to a virtual network, NAT Gateway provides outbound connectivity using its own public IP, and service endpoint policies refine access to service endpoints without requiring an IP address.