Your on-premises network includes a VPN gateway. Your Azure subscription contains the resources shown in the table. How can you ensure that traffic between VM1 and storage1 flows across the Microsoft backbone?

Service endpoints allow traffic from your virtual network to Azure services like Storage to flow directly over the Azure backbone network, bypassing the public internet. This provides optimized routing and enhanced security. Azure AD Application Proxy is used for publishing on-premises web apps securely to external users, not for internal Azure traffic optimization. A Network Security Group (NSG) filters network traffic to and from Azure resources within a virtual network but doesn't dictate the routing path to Azure services. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources, but it doesn't specifically route traffic to Azure services over the backbone; service endpoints handle that.