AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a new storage account in VNet B.

  Why it's wrong here

  Storage accounts are Azure PaaS resources and are never deployed directly into a VNet, so creating a new storage account in VNet B is not a valid action. Even if a new account were created, it would be a separate resource with its own public or private endpoint configuration, and it would not solve the DNS resolution issue for the existing private endpoint in VNet A. This option simply does not address the root cause of the problem.

  When this WOULD be correct

  If the question asked how to ensure a VM in VNet B can access storage with lowest latency and without traversing the public internet, creating a storage account in VNet B with a service endpoint or private endpoint would be correct.

• ✓

  Link the private DNS zone for the storage service to VNet B.

  Why this is correct

  A private endpoint assigns the storage account a private IP address in VNet A, but name resolution from VNet B must still map the storage service FQDN to that private IP. Linking the private DNS zone to VNet B enables DNS resolution across the peered network, so clients in VNet B can resolve the storage account to its private endpoint. This is the standard approach for enabling private connectivity to a PaaS service over VNet peering.

• ✗

  Add an inbound NSG rule allowing DNS traffic from VNet B.

  Why it's wrong here

  Network security group (NSG) rules control which traffic is allowed or denied through a subnet or NIC, but they have no role in DNS name resolution. Adding an inbound rule for DNS (TCP/UDP 53) would only permit the traffic; it cannot instruct clients in VNet B to resolve the storage FQDN to the private IP address assigned by the private endpoint in VNet A. Since clients do not know the private IP, the NSG rule would be ineffective.

  When this WOULD be correct

  If a VM in VNet B cannot resolve the storage account name at all (e.g., DNS query times out), and the private DNS zone is already linked to VNet B, then an inbound NSG rule allowing UDP port 53 from VNet B to the DNS server (Azure-provided or custom) would be needed to permit DNS traffic.

• ✗

  Replace the private endpoint with a service endpoint.

  Why it's wrong here

  A service endpoint replaces the private endpoint with public IP-based routing through the service's public endpoint, meaning the storage account is not assigned a private IP address in VNet A. This would remove the private DNS zone linkage and force clients in VNet B to resolve the storage FQDN to a public IP address, which defeats the purpose of private connectivity and does not provide the required private DNS resolution.

  When this WOULD be correct

  A question asks how to ensure traffic from a VM to a storage account stays within the Azure backbone without using a private endpoint, and the storage account does not require private IP resolution. Service endpoints would be the correct choice to route traffic privately.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question