AZ-104 Implement and Manage Storage Practice Question
A development subnet must access an Azure Storage account privately, but the security team does not want to create a private IP in the VNet. They only want the subnet identity to be extended to the storage service. Which feature should the administrator configure?
⚠ Common exam trap
Candidates often confuse service endpoints with private endpoints, assuming both require a private IP, but service endpoints use the subnet's identity without assigning a private IP, which is the key distinction tested in this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service endpoint
A service endpoint extends the VNet identity to the Azure Storage service, allowing traffic from the subnet to reach the storage account over the Azure backbone network without requiring a private IP. This meets the requirement of private access without creating a private IP in the VNet, as the subnet's identity is used for access control via the storage account firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Private endpoint
Why it's wrong here
A private endpoint is incorrect because it creates a private IP address in the VNet and establishes a network interface for the storage account. The security team explicitly wants to avoid a private IP-based connection, so this approach directly contradicts the stated requirement. Service endpoints, by contrast, do not add any IPs to the VNet; they extend the subnet's identity to the service.
When this WOULD be correct
A question where the requirement is to access an Azure Storage account privately with a private IP address within the VNet, ensuring traffic never traverses the public internet.
- ✓
Service endpoint
Why this is correct
A service endpoint extends the VNet and subnet identity to the supported Azure service without creating a private IP address in the VNet. That fits the requirement exactly because the team wants private access semantics from the subnet while avoiding a private endpoint. It is the correct choice when the main goal is to restrict service access to a subnet rather than provide a private IP-based connection.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is an application delivery and global load-balancing service that operates at the edge, routing HTTP/HTTPS traffic to backend origins. It does not integrate at the subnet level or provide a mechanism to restrict storage access to a specific subnet. Storage accounts accessed via Front Door would still use public endpoints, so this option fails to meet the private access and subnet-scoped security goals.
When this WOULD be correct
A company needs to provide secure, fast, and scalable global access to a web application hosted in Azure, with features like SSL termination, URL-based routing, and WAF. In that scenario, Azure Front Door would be the correct answer.
- ✗
Network security group outbound rule
Why it's wrong here
An NSG outbound rule controls allowed or denied traffic by IP address, port, and protocol, but it cannot provide connectivity to a service or extend a subnet's identity. A rule permitting outbound traffic to the storage account's public IP would still rely on the public endpoint, and the storage account would not be able to restrict access to the subnet based on the rule. NSGs are a filtering control, not a connectivity or identity mechanism.
When this WOULD be correct
An NSG outbound rule would be correct in a scenario where the question asks how to block or allow specific outbound traffic from a subnet to an Azure Storage account, such as denying all outbound traffic except to a specific storage endpoint for security compliance.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Service endpointCorrect answer▾
Why this is correct
A service endpoint extends the VNet and subnet identity to the supported Azure service without creating a private IP address in the VNet. That fits the requirement exactly because the team wants private access semantics from the subnet while avoiding a private endpoint. It is the correct choice when the main goal is to restrict service access to a subnet rather than provide a private IP-based connection.
✗Private endpointWrong answer — click to see why▾
Why this is wrong here
Private endpoint creates a private IP in the VNet, which the security team explicitly wants to avoid. The requirement is to extend the subnet identity to the storage service without a private IP.
★ When this WOULD be the correct answer
A question where the requirement is to access an Azure Storage account privately with a private IP address within the VNet, ensuring traffic never traverses the public internet.
Why candidates choose this
Candidates may confuse private endpoint with service endpoint, both providing private access, but fail to note the key difference that private endpoint uses a private IP, which is prohibited here.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door is a global load balancer and application delivery network for HTTP/HTTPS traffic, not a feature to extend subnet identity to Azure Storage for private access. It does not provide private connectivity from a subnet to a storage account.
★ When this WOULD be the correct answer
A company needs to provide secure, fast, and scalable global access to a web application hosted in Azure, with features like SSL termination, URL-based routing, and WAF. In that scenario, Azure Front Door would be the correct answer.
Why candidates choose this
Candidates may confuse Azure Front Door's ability to route traffic to Azure services with private connectivity, or think it can replace service endpoints for storage access due to its integration with Azure services.
✗Network security group outbound ruleWrong answer — click to see why▾
Why this is wrong here
Network security group (NSG) outbound rules control traffic filtering, not private connectivity or identity extension to a service. They cannot provide a private subnet identity to Azure Storage.
★ When this WOULD be the correct answer
An NSG outbound rule would be correct in a scenario where the question asks how to block or allow specific outbound traffic from a subnet to an Azure Storage account, such as denying all outbound traffic except to a specific storage endpoint for security compliance.
Why candidates choose this
Candidates may confuse traffic filtering with connectivity, thinking that an NSG rule can establish private access by allowing outbound traffic to the storage service, but it only controls allowed destinations, not the network path or identity.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.