AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A service endpoint on the subnet and a storage account firewall rule allowing that subnet.

  Why it's wrong here

  Service endpoints still use the storage account's public endpoint, even though traffic stays on Microsoft's backbone. They do not create a private IP in the VNet, so they do not satisfy the requirement for private address resolution. This option also does not match the disabled public access requirement as cleanly as a private endpoint.

  When this WOULD be correct

  A service endpoint would be correct if the question asked for securing access from a VNet to a storage account without requiring private IP resolution, and the application could use the public endpoint with firewall rules. For example: 'A storage account must be accessible only from a specific VNet subnet, and the application can use the public endpoint.'

• ✓

  A private endpoint for the storage account and a corresponding private DNS zone link.

  Why this is correct

  A private endpoint places the storage service on a private IP inside the VNet, and DNS integration allows the storage FQDN to resolve to that private address. That combination meets both requirements: private connectivity and no application code changes. This is the standard pattern when public network access is disabled.

• ✗

  An account SAS token with read/write permissions for the application.

  Why it's wrong here

  A SAS token controls authorization, not network path or name resolution. It cannot force traffic to use a private IP address or replace DNS configuration. The problem is network access, so changing the authentication method does not solve it.

  When this WOULD be correct

  An administrator needs to grant a client application time-limited, delegated access to specific storage resources (e.g., blobs or files) without sharing the account key, and the storage account's public network access is enabled. The application can use the SAS token in the connection string or URL.

• ✗

  Allow trusted Microsoft services to bypass the storage firewall.

  Why it's wrong here

  Trusted services are useful in certain storage firewall scenarios, but they do not provide a private IP in the VNet or private DNS resolution. They also are not the correct pattern for a VM in a customer VNet that needs private access. The requirement is private endpoint connectivity.

  When this WOULD be correct

  This option would be correct in a scenario where the storage account has public network access disabled, but the application needs to access it from an Azure service (like Azure Backup or Azure Logic Apps) that is listed as a trusted Microsoft service, and the requirement is to allow that service without exposing the storage account to the public internet.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question