AZ-104 Implement and Manage Storage Practice Question
A storage account must be accessible only from one virtual network, and the storage service must have a private IP address inside that network. Public network access should be disabled. Which solution should the administrator use?
⚠ Common exam trap
It's easy for candidates to confuse service endpoints (which still leave the public endpoint enabled and only provide source-side filtering) with private endpoints (which provide a private IP and fully disable public access).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private endpoint for the storage account in the virtual network
A private endpoint assigns the storage account a private IP address from the virtual network's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone. This ensures the storage account is accessible only from that virtual network and allows public network access to be disabled, meeting both requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a storage firewall rule that allows the subnet's public IP range
Why it's wrong here
A storage firewall rule operates at the public endpoint, filtering traffic by source IP address before it reaches the service. It does not add a private IP to the VNet, so the storage account still lives on the public internet. Moreover, a subnet's 'public IP range' is typically not the source address for outbound Azure traffic due to NAT, making this rule ineffective, and it would still permit public internet access from any allowed IP.
When this WOULD be correct
If the requirement was to allow access only from a specific subnet's public IP range while keeping the storage account publicly accessible from other IPs, a firewall rule would be appropriate.
- ✗
Configure a service endpoint for the subnet and keep public access enabled
Why it's wrong here
A service endpoint routes traffic from the subnet to the storage service's regional public IP using the subnet's identity, but it does not create a private IP for the storage account inside the VNet. With public access still enabled, the storage account remains reachable from any internet location, not just the VNet. This violates the 'only from one VNet' requirement, because public access must be disabled to enforce the restriction.
When this WOULD be correct
If the requirement were to allow access from a specific subnet without assigning a private IP, and public access could remain enabled, then configuring a service endpoint for that subnet would be correct.
- ✓
Create a private endpoint for the storage account in the virtual network
Why this is correct
A private endpoint assigns the storage account a network interface with a private IP address from your VNet's subnet, placing the service effectively inside the virtual network. Traffic to the storage account then traverses the Microsoft backbone rather than the public internet. Once created, you can disable public network access, and the only remaining path is through the private endpoint, guaranteeing that only your VNet can reach the storage account.
- ✗
Peer the virtual network to the storage account's region
Why it's wrong here
VNet peering connects two virtual networks to allow direct communication between their resources; a storage account is a global service, not a virtual network, so it cannot be peered. Peering does not place the storage service in your VNet or give it a private IP address. Additionally, 'peering to a region' is a misconception—peering is between VNets, and the storage account would still be accessed via its public endpoint without a private link mechanism.
When this WOULD be correct
An administrator needs to connect two virtual networks in different regions to allow resources in one VNet to communicate with resources in the other VNet using private IP addresses, without requiring a VPN gateway or ExpressRoute.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a private endpoint for the storage account in the virtual networkCorrect answer▾
Why this is correct
A private endpoint assigns the storage account a network interface with a private IP address from your VNet's subnet, placing the service effectively inside the virtual network. Traffic to the storage account then traverses the Microsoft backbone rather than the public internet. Once created, you can disable public network access, and the only remaining path is through the private endpoint, guaranteeing that only your VNet can reach the storage account.
✗Add a storage firewall rule that allows the subnet's public IP rangeWrong answer — click to see why▾
Why this is wrong here
This option only restricts access by IP address, but the storage account would still have a public IP and public endpoint, failing the requirement for a private IP address and disabled public network access.
★ When this WOULD be the correct answer
If the requirement was to allow access only from a specific subnet's public IP range while keeping the storage account publicly accessible from other IPs, a firewall rule would be appropriate.
Why candidates choose this
Candidates may think that a firewall rule is sufficient to restrict access to a single subnet, overlooking the need for a private IP and complete disabling of public access.
✗Configure a service endpoint for the subnet and keep public access enabledWrong answer — click to see why▾
Why this is wrong here
A service endpoint does not assign a private IP address to the storage account; it only allows traffic from the subnet via the public endpoint while keeping public access enabled, which violates the requirement to disable public network access.
★ When this WOULD be the correct answer
If the requirement were to allow access from a specific subnet without assigning a private IP, and public access could remain enabled, then configuring a service endpoint for that subnet would be correct.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private connectivity, but service endpoints still use the public endpoint and do not disable public access.
✗Peer the virtual network to the storage account's regionWrong answer — click to see why▾
Why this is wrong here
VNet peering connects virtual networks, but does not assign a private IP to the storage account or disable public access. The storage account would still have a public endpoint, and peering alone does not restrict access to a single VNet.
★ When this WOULD be the correct answer
An administrator needs to connect two virtual networks in different regions to allow resources in one VNet to communicate with resources in the other VNet using private IP addresses, without requiring a VPN gateway or ExpressRoute.
Why candidates choose this
Candidates may confuse VNet peering with private connectivity, thinking that peering can provide private IP access to Azure services, or they may assume that peering inherently restricts public access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
Key term
Private Link
Private Link is a technology that lets you connect your virtual network to a service over a private, secure connection inside the cloud provider's infrastructure, instead of going over the public internet.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.