AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account has public network access disabled. A VM in a virtual network must access blob data privately, and the application must resolve the storage endpoint name to a private IP address. What should the administrator deploy?
⚠ Common exam trap
Many exam-takers confuse service endpoints (which provide source IP preservation but no private IP) with private endpoints (which provide a true private IP and private DNS resolution), leading them to choose Option A or C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint for the storage account plus a private DNS zone linked to the virtual network
A private endpoint assigns the storage account a private IP from the VM's virtual network, enabling direct, secure access over the Microsoft backbone. A private DNS zone linked to the virtual network ensures the storage endpoint name (e.g., mystorageaccount.blob.core.windows.net) resolves to that private IP, meeting the requirement for private name resolution without relying on public DNS or hosts file entries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service endpoint for Microsoft.Storage and a custom hosts file entry on the VM
Why it's wrong here
A service endpoint for Microsoft.Storage does not place the storage service on a private IP inside your VNet; it only adds a source VNet identity to traffic that still goes to the public endpoint. With public network access disabled, service endpoints cannot be used at all. Adding a custom hosts file entry on the VM is a manual, non-scalable workaround that would map the storage hostname to a public IP (or an arbitrary address) and would not integrate with Azure DNS or enforce private connectivity—so this combination fails to meet the requirement.
When this WOULD be correct
This option would be correct if the question required accessing the storage account from an on-premises network via a VPN or ExpressRoute, and the goal was to ensure traffic stays within the Microsoft backbone without needing private IP resolution. In that case, a service endpoint combined with a hosts file entry could be a workaround for name resolution.
- ✓
A private endpoint for the storage account plus a private DNS zone linked to the virtual network
Why this is correct
A private endpoint places the storage service on a private IP address inside the VNet, which satisfies the private access requirement. A private DNS zone is then needed so the storage account name resolves to that private IP address from within the virtual network. Together, they provide secure, private connectivity with proper name resolution.
- ✗
Allow trusted Microsoft services and keep using the public endpoint
Why it's wrong here
The 'Allow trusted Microsoft services' exception is intended for specific Azure PaaS services (e.g., Azure Data Factory or Azure Backup) that need to bypass the storage firewall; it does not apply to a regular VM. Even if that exception were enabled, traffic would still traverse the public endpoint over the internet, not a private IP inside your VNet. Since the storage account has public network access disabled, this option cannot provide the required private, secure connectivity.
When this WOULD be correct
This would be correct if the question required allowing a specific Azure service (e.g., Azure Backup or Azure Logic Apps) to access a storage account with public network access disabled, without needing private IP resolution.
- ✗
A route table that sends traffic for the storage account's public IP to the VPN gateway
Why it's wrong here
A route table with a route to the VPN gateway would only change the next hop for traffic bound to the storage account's public IP, but it does not change the fact that the public endpoint is disabled. The VM would still be sending packets to a public IP address, and the gateway would need to forward them out to the internet—there is no private IP assigned to the storage account in your VNet. Additionally, DNS for the storage account would still resolve to the public IP, and no private DNS zone is involved, so this does not meet the private access requirement.
When this WOULD be correct
An administrator needs to force all traffic from a specific subnet to a storage account's public IP through a VPN gateway or NVA for inspection or logging, while still using the public endpoint. In that case, a route table with a user-defined route would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpoint for the storage account plus a private DNS zone linked to the virtual networkCorrect answer▾
Why this is correct
A private endpoint places the storage service on a private IP address inside the VNet, which satisfies the private access requirement. A private DNS zone is then needed so the storage account name resolves to that private IP address from within the virtual network. Together, they provide secure, private connectivity with proper name resolution.
✗A service endpoint for Microsoft.Storage and a custom hosts file entry on the VMWrong answer — click to see why▾
Why this is wrong here
Service endpoints do not provide a private IP address for the storage endpoint; they route traffic over the Microsoft backbone but the DNS name still resolves to a public IP. A custom hosts file entry is not a scalable or managed solution and does not integrate with Azure Private DNS for automatic resolution.
★ When this WOULD be the correct answer
This option would be correct if the question required accessing the storage account from an on-premises network via a VPN or ExpressRoute, and the goal was to ensure traffic stays within the Microsoft backbone without needing private IP resolution. In that case, a service endpoint combined with a hosts file entry could be a workaround for name resolution.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private connectivity. The hosts file entry seems like a simple fix for DNS resolution, but they overlook that Azure Private DNS zones automatically manage private IP mapping without manual entries.
✗Allow trusted Microsoft services and keep using the public endpointWrong answer — click to see why▾
Why this is wrong here
This option does not provide private IP resolution; the storage account's public endpoint remains accessible, and 'Allow trusted Microsoft services' bypasses network restrictions but does not enable private connectivity or private DNS resolution.
★ When this WOULD be the correct answer
This would be correct if the question required allowing a specific Azure service (e.g., Azure Backup or Azure Logic Apps) to access a storage account with public network access disabled, without needing private IP resolution.
Why candidates choose this
Candidates may think that enabling trusted Microsoft services is a simple way to grant access without configuring private endpoints, overlooking the requirement for private IP resolution.
✗A route table that sends traffic for the storage account's public IP to the VPN gatewayWrong answer — click to see why▾
Why this is wrong here
A route table cannot resolve the storage endpoint name to a private IP address; it only controls traffic routing based on IP addresses, not DNS resolution. The question requires private name resolution, which a route table does not provide.
★ When this WOULD be the correct answer
An administrator needs to force all traffic from a specific subnet to a storage account's public IP through a VPN gateway or NVA for inspection or logging, while still using the public endpoint. In that case, a route table with a user-defined route would be correct.
Why candidates choose this
Candidates may confuse network routing with DNS resolution, thinking that directing traffic to a specific path (like VPN) can also achieve private connectivity and name resolution, but routing alone does not change how the endpoint name is resolved.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.