A storage account has public network access disabled. An app in a VNet must read and write blobs privately, and the team wants the blob endpoint name to resolve to a private IP without exposing the service publicly. What should the administrator configure?

A service endpoint on the subnet and a storage firewall allow rule.

Service endpoints still use the public service endpoint and do not provide a private IP.

A public IP address for the app and allow access from that IP in the storage firewall.

This keeps the service public and does not meet the private connectivity requirement.

An NSG rule that allows outbound TCP 443 from the app subnet to storage.

NSGs control traffic, but they do not create private name resolution or service exposure.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A private endpoint for the storage account and a private DNS zone for blob name resolution. — Because public network access is disabled, the application needs a private path to the storage account. A private endpoint places a private IP address for the storage service inside the VNet, and a private DNS zone ensures the blob FQDN resolves to that private address. This combination keeps traffic on the Azure backbone and avoids exposing the account through its public endpoint. Why others are wrong: Service endpoints do not assign a private IP and still depend on the public service address. A public IP and firewall rule keep the service publicly reachable, which conflicts with the requirement. NSG rules can allow or block traffic but cannot change DNS resolution or create private connectivity. The missing pieces are private endpoint placement and private DNS integration.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.