You have an on-premises network named Site1.
You have an Azure subscription that contains a virtual network named VNet1 and a storage account named storage1.
Site1 and VNet1 are connected by using a Site-to-Site (S2S) VPN.
You need to ensure that the servers in Site1 can connect to storage1 by using the S2S VPN. The solution must minimize administrative effort.
What should you create on VNet1?

A. an Azure application gateway B. an Azure Private Link service C. a service endpoint D. a private endpoint