AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A service endpoint on the subnet and a storage firewall allow rule.

  Why it's wrong here

  Service endpoints route traffic from the subnet to the storage account over the Microsoft backbone, but they do not assign a private IP to the storage account — the endpoint is still accessed via its public IP address, and DNS continues to resolve to that public endpoint. More critically, the storage account has public network access disabled, which invalidates any firewall allow rule for service endpoints because that setting blocks all traffic originating from the public endpoint, regardless of source. Service endpoints also require a record in the storage firewall, but they never give the storage account a private IP in the VNet, so they fail the private connectivity requirement.

  When this WOULD be correct

  If the storage account had public network access enabled and the requirement was to restrict access to a specific VNet without private IP resolution, a service endpoint on the subnet and a storage firewall allow rule would be correct.

• ✗

  A public IP address for the app and allow access from that IP in the storage firewall.

  Why it's wrong here

  This approach is fundamentally flawed because the storage account has public network access disabled, which means all IP firewall rules in the storage firewall are ignored — the public endpoint is completely shut down. Even if the an allowed public IP were added, the storage service will not accept any traffic from the internet, so the app's traffic would be rejected before the firewall rule is evaluated. Additionally, this does nothing to provide private IP connectivity; the app would still traverse the public internet to reach the blob service, violating the private connectivity requirement.

  When this WOULD be correct

  If the requirement were to allow access from a specific public IP (e.g., an on-premises firewall) while still using the public endpoint, and public network access was enabled, this would be correct.

• ✗

  An NSG rule that allows outbound TCP 443 from the app subnet to storage.

  Why it's wrong here

  An NSG rule that permits outbound TCP 443 to the storage service is irrelevant here because NSGs operate at the network layer and only filter traffic; they do not create a private IP for the storage account or alter DNS resolution. Without a private endpoint, the app's DNS resolution will still return the storage account's public IP, and because public network access is disabled, the connection will be dropped by the platform — the NSG allow rule never even comes into play. Even if the NSG were properly configured, it cannot substitute for the private connectivity and name resolution that only Private Link and a private DNS zone can provide.

  When this WOULD be correct

  If the question were: 'An app in a VNet needs to access a storage account over the public internet, but the storage firewall blocks all traffic by default. What should be configured to allow outbound HTTPS traffic from the app subnet?' Then an NSG rule allowing outbound TCP 443 would be correct.

• ✓

  A private endpoint for the storage account and a private DNS zone for blob name resolution.

  Why this is correct

  A private endpoint assigns the storage account a private IP address from your VNet (via a network interface in the app subnet), so all traffic to the blob service stays within the Microsoft backbone. The private DNS zone for blob name resolution is essential because it overrides the default public CNAME record for the storage account, causing `mystorageaccount.blob.core.windows.net` to resolve to that private IP instead of the public endpoint. This combination meets both requirements: private connectivity and name resolution, even when public network access is disabled.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question