A storage account has public network access disabled. An application runs on a VM in a VNet and must access the storage account over a private IP address. The team also wants the storage name to resolve to a private address inside the VNet without changing application code. What should the administrator create?

A service endpoint on the subnet and a storage account firewall rule allowing that subnet.

Service endpoints still use the storage account's public endpoint, even though traffic stays on Microsoft's backbone. They do not create a private IP in the VNet, so they do not satisfy the requirement for private address resolution. This option also does not match the disabled public access requirement as cleanly as a private endpoint.

An account SAS token with read/write permissions for the application.

A SAS token controls authorization, not network path or name resolution. It cannot force traffic to use a private IP address or replace DNS configuration. The problem is network access, so changing the authentication method does not solve it.

Allow trusted Microsoft services to bypass the storage firewall.

Trusted services are useful in certain storage firewall scenarios, but they do not provide a private IP in the VNet or private DNS resolution. They also are not the correct pattern for a VM in a customer VNet that needs private access. The requirement is private endpoint connectivity.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A private endpoint for the storage account and a corresponding private DNS zone link. — A private endpoint is the correct solution when an Azure VM must access storage privately and the service should resolve to a private IP inside the VNet. Private DNS integration ensures the storage account name resolves correctly without application changes. Because public network access is disabled, a service endpoint is not enough; the service must be exposed through a private endpoint path. Why others are wrong: Service endpoints still rely on the public service endpoint and do not create a private IP. SAS tokens only affect authorization, not network routing or DNS. Trusted services are meant for certain platform integrations and do not give a VM in a VNet the private, name-resolved connectivity that this scenario requires.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.