Your on-premises network includes a VPN gateway. You have Azure resources including VM1 and storage1. To ensure all traffic from VM1 to storage1 uses the Microsoft backbone network, which configuration should you use?

Private Endpoints are the correct solution because they provide a secure, private connection from your virtual network to Azure services like Storage Accounts over the Microsoft backbone network. This ensures traffic between VM1 and storage1 remains within Azure's private network, bypassing the public internet. Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications, not to private Azure services. A Network Security Group (NSG) filters network traffic to and from Azure resources within a virtual network, but it doesn't establish a private connection to a service like Storage Account. Azure Virtual WAN is a networking service that brings many networking, security, and routing functionalities together to provide a single operational interface, but it's not designed for privately connecting a VM to a specific Azure service within the same region over the backbone network in this manner.