The correct answer is D, a service endpoint. A service endpoint allows traffic to Azure Storage to be routed directly from the virtual network to the storage account, without going over the internet. While a network security group (NSG) can be used to permit/deny traffic, using a service endpoint is specifically designed to enhance security by enabling direct connectivity to Azure services over the Azure backbone network. This prevents the traffic from being exposed to the public internet.