AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable a service endpoint on VNet B for Microsoft.Storage.

  Why it's wrong here

  Enabling a service endpoint for Microsoft.Storage on VNet B establishes direct private connectivity to the storage service over the Microsoft backbone, but it does not integrate with Azure Private DNS zones and does not change how the storage account's FQDN resolves. Private endpoints rely on DNS resolution to a private IP address within VNet B, and service endpoints do not provide that mapping. In fact, service endpoints route to the service's public IP ranges, so this option would still leave the VM trying to reach the public endpoint instead of the private IP, leaving the connectivity problem unresolved.

  When this WOULD be correct

  A service endpoint would be correct if the question stated that VMs in VNet B need to access the storage account from on-premises or another network without a private endpoint, and the goal is to ensure traffic to the storage account stays within the Azure backbone. For example: 'A storage account is accessed from a VM in VNet B via the public endpoint. The administrator wants to ensure traffic to the storage account does not traverse the internet.'

• ✓

  Link the private DNS zone for the storage account to VNet B.

  Why this is correct

  The name resolution problem indicates that VNet B does not know to resolve the storage FQDN to the private endpoint address. Linking the correct private DNS zone to VNet B lets machines in that network resolve the name to the private IP instead of the public endpoint. This is a common requirement when private endpoints are accessed from peered networks or additional VNets.

• ✗

  Assign the VM in VNet B a managed identity.

  Why it's wrong here

  Assigning the VM in VNet B a managed identity changes how the VM authenticates to Azure Active Directory and Azure services, but it does not alter how the VM resolves DNS names. The reported problem is that the storage account's FQDN is still resolving to the public IP, indicating a name resolution failure, not an authorization failure. Managed identity would, at best, grant the VM permission to access the storage account via the public endpoint—bypassing the private endpoint entirely—so it cannot fix the DNS resolution issue.

• ✗

  Create a route table that points storage traffic to the private endpoint subnet.

  Why it's wrong here

  Creating a route table that forces storage-bound traffic to the private endpoint subnet is unnecessary and ineffective because private endpoint access is controlled by DNS resolution to a specific private IP address, not by policy-based routing. The VM's traffic to that private IP will already route correctly via the VNet's default route to the subnet; overriding it with a custom route could even cause asymmetric routing. Moreover, private endpoints are not a route-table destination—they are network interface attachments, and traffic to them is not subject to user-defined routes beyond the VNet's built-in IP routing, so this option does nothing to address DNS resolution.

  When this WOULD be correct

  If the VM in VNet B could already resolve the storage account name to the private endpoint IP (e.g., via a private DNS zone linked to VNet B), but traffic was still going over the public internet due to asymmetric routing or missing routes, then a route table forcing traffic to the private endpoint subnet would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question