AZ-104 Implement and Manage Storage Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a service endpoint on the subnet and allow that subnet in the storage account firewall.

  Why this is correct

  A service endpoint is the correct design because it restricts access to a specific subnet without creating a private IP address for the storage account. The storage account can continue to use its public FQDN, which matches the requirement. By enabling the service endpoint on the subnet and then permitting that subnet in the storage firewall, traffic is locked down while avoiding private endpoint and private DNS complexity.

• ✗

  Create a private endpoint for the storage account and disable public network access.

  Why it's wrong here

  A private endpoint assigns a private IP address to the storage account from your virtual network, which is a level of network isolation the scenario does not require; the requirement is simply to restrict access to one subnet, not to remove the storage account from the public internet. Additionally, private endpoints require configuring private DNS zones and managing per-service private IPs, adding complexity that a service endpoint avoids. Disabling public network access when using a private endpoint is a separate step and would still leave the private IP in place, contradicting the intent that the storage account retain its existing public namespace without a private IP.

  When this WOULD be correct

  This option would be correct in a scenario where the security team requires the storage account to be completely isolated from the public internet, using a private endpoint for connectivity, and they are willing to manage private DNS zones for name resolution.

• ✗

  Use an NSG rule to allow only the subnet to reach port 443 on the storage account.

  Why it's wrong here

  NSGs operate at the network layer (L3/L4) and cannot restrict access to a PaaS storage account's public endpoint, because the storage account firewall itself evaluates each request by source IP, not by which subnet the traffic originated from. An NSG rule permitting subnet A to reach port 443 on the storage account's public IP would still allow any other subnet or the internet to reach that same public IP unless the storage account firewall were also locked down. NSGs do not inject any Azure service-specific source identifier, so they are insufficient as the only access control mechanism.

  When this WOULD be correct

  If the question required restricting inbound traffic to a virtual machine's public IP on port 443 from only a specific subnet, an NSG rule on the subnet would be the correct answer.

• ✗

  Associate a route table that sends storage traffic to an Azure firewall appliance.

  Why it's wrong here

  A route table with a route sending storage-bound traffic to an Azure firewall only changes the next hop for packets; it does not make the storage account accessible only from one subnet because any subnet whose route points to the firewall (or even the internet) can still attempt to reach the storage account if the storage account firewall permits it. The Azure firewall might inspect and filter traffic, but it does not provide a way for the storage account's firewall to validate the source subnet in the same way a service endpoint does. Without a service endpoint, the storage account sees only the source IP address, so the routing solution fails to enforce subnet-level exclusivity.

  When this WOULD be correct

  This option would be correct in a scenario where the requirement is to inspect or filter all traffic to the storage account through a central firewall for security monitoring, while still allowing access from multiple subnets or on-premises networks.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question