AZ-104 Implement and Manage Virtual Networking Practice Question
A payroll application in a VNet must access an Azure Storage account containing confidential blobs. The security team requires the storage account to be reachable only over a private IP, and public network access must be disabled. Which feature should the administrator implement?
⚠ Common exam trap
Candidates often confuse service endpoints with private endpoints, not realizing that service endpoints still use the public endpoint and cannot disable public network access, whereas private endpoints provide a true private IP and full public access disablement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint for the storage account in the VNet.
A private endpoint assigns the storage account a private IP address from the VNet, enabling secure access over a private connection while completely disabling public network access. This meets the security team's requirement because traffic never traverses the public internet, and the storage account's firewall can be configured to deny all public traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service endpoint for Microsoft.Storage on the application subnet.
Why it's wrong here
A service endpoint for Microsoft.Storage does not give the storage account a private IP address; it only adds the VNet's identity to the traffic and routes it over the Microsoft backbone to the storage account's public endpoint. The storage endpoint remains publicly reachable, and access is limited via source network rules rather than a fully private network path. This does not satisfy a requirement to remove the storage account from public exposure entirely.
When this WOULD be correct
A service endpoint would be correct if the question required securing access from a VNet to a storage account without disabling public network access, or if the requirement was to restrict access to a specific subnet while still using the public endpoint.
- ✓
A private endpoint for the storage account in the VNet.
Why this is correct
A private endpoint gives the storage account a private IP address from the VNet address space, allowing traffic to stay on private connectivity. This matches the requirement to disable public network access while still letting the application reach blob data. The private endpoint also integrates with DNS so the storage FQDN resolves to the private address. That design is the correct choice when access must be restricted to a private path only.
- ✗
A shared access signature embedded in the application configuration.
Why it's wrong here
A shared access signature (SAS) is an authorization token that grants scoped, time-limited access to specific storage resources over HTTPS. It controls who can call the storage data plane, but it does not alter the underlying network path or provide any form of private connectivity. The storage account still has a public endpoint reachable from the internet, so a SAS cannot meet a mandate to disable public network access and restrict traffic to a private interface.
When this WOULD be correct
An administrator needs to grant a client application time-limited, delegated access to specific blobs in a storage account without exposing the account key, and public network access is allowed. A SAS token embedded in the app configuration would be appropriate.
- ✗
A VPN gateway connection between the subnet and the storage account.
Why it's wrong here
A VPN gateway establishes an encrypted IPSec tunnel between your VNet and an on-premises network or another VNet. The Azure Storage service is a PaaS offering with a public endpoint, not a network endpoint you can terminate a VPN connection to, so there is no way to establish a VPN tunnel directly to a storage account. Even if you routed traffic through a VPN gateway, it would not create a private IP address for the storage account in your VNet, leaving the public endpoint as the only destination.
When this WOULD be correct
A VPN gateway would be correct if the question required connecting an on-premises network to a VNet to access Azure resources privately, or if the storage account needed to be accessed from on-premises over a private connection without using the public internet.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpoint for the storage account in the VNet.Correct answer▾
Why this is correct
A private endpoint gives the storage account a private IP address from the VNet address space, allowing traffic to stay on private connectivity. This matches the requirement to disable public network access while still letting the application reach blob data. The private endpoint also integrates with DNS so the storage FQDN resolves to the private address. That design is the correct choice when access must be restricted to a private path only.
✗A service endpoint for Microsoft.Storage on the application subnet.Wrong answer — click to see why▾
Why this is wrong here
A service endpoint does not provide a private IP; it allows access over the public endpoint but restricts it to the VNet. The requirement is to disable public network access entirely, which only a private endpoint can achieve.
★ When this WOULD be the correct answer
A service endpoint would be correct if the question required securing access from a VNet to a storage account without disabling public network access, or if the requirement was to restrict access to a specific subnet while still using the public endpoint.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private connectivity, but service endpoints still use the public IP of the storage service.
✗A shared access signature embedded in the application configuration.Wrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) provides delegated access over the public endpoint, but the question requires public network access to be disabled and only private IP access allowed. SAS does not enforce private-only connectivity.
★ When this WOULD be the correct answer
An administrator needs to grant a client application time-limited, delegated access to specific blobs in a storage account without exposing the account key, and public network access is allowed. A SAS token embedded in the app configuration would be appropriate.
Why candidates choose this
Candidates may think SAS is a secure way to control access to storage, but they overlook the requirement that public access must be disabled entirely, which SAS cannot enforce.
✗A VPN gateway connection between the subnet and the storage account.Wrong answer — click to see why▾
Why this is wrong here
A VPN gateway connection does not provide private IP access to the storage account; it only extends the VNet to on-premises networks. The storage account would still be publicly accessible unless additional measures are taken, and it does not disable public network access.
★ When this WOULD be the correct answer
A VPN gateway would be correct if the question required connecting an on-premises network to a VNet to access Azure resources privately, or if the storage account needed to be accessed from on-premises over a private connection without using the public internet.
Why candidates choose this
Candidates may confuse VPN gateways with private connectivity solutions, thinking that a VPN tunnel inherently provides private IP access to all Azure services, not realizing that storage accounts require explicit private endpoints for private IP access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.