AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account must be reachable only from a single Azure VNet. The team wants the storage account to have a private IP in that VNet and wants to disable public network access. Which solution should the administrator implement?
⚠ Common exam trap
A common mix-up: candidates confuse service endpoints with private endpoints, assuming a service endpoint provides a private IP, when in fact it only provides a public endpoint with a VNet source identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private endpoint for the storage account and disable public network access.
A private endpoint assigns the storage account a private IP from the VNet, making it accessible only within that VNet over a private connection. Disabling public network access ensures no traffic can reach the storage account from the internet, meeting both requirements. This is the only option that provides a private IP and blocks all public access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a service endpoint on the subnet and keep public network access enabled.
Why it's wrong here
A service endpoint makes traffic from your subnet go to the Azure service over the Microsoft backbone, but the storage account is still fronted by its public endpoint, and it does not receive a private IP address. Keeping public network access enabled means clients from anywhere can still reach the storage account over the internet, limited only by network ACLs. This does not satisfy the requirement to isolate the storage account to a single VNet because it still uses the publicly routable service endpoint.
When this WOULD be correct
A service endpoint would be correct if the requirement was to allow access from a specific VNet without needing a private IP, and public network access could remain enabled for other sources (e.g., from on-premises via firewall rules).
- ✓
Create a private endpoint for the storage account and disable public network access.
Why this is correct
A private endpoint places a private IP address in the VNet for the storage service, allowing traffic to stay on the private network path. Disabling public network access ensures the service cannot be reached through its public endpoint.
- ✗
Assign a shared access signature and rely on IP-based firewall rules.
Why it's wrong here
A shared access signature (SAS) is an authorization mechanism that grants limited access to storage resources via a token; it does nothing to change the network path or address assignment. IP-based firewall rules are evaluated at the storage account's public endpoint, so any allowed IP can still connect over the internet, and the storage account still has no private IP in your VNet. Furthermore, the combination of a SAS and firewall rules does not ensure traffic stays exclusively within a specific virtual network.
When this WOULD be correct
An administrator needs to grant temporary, delegated access to a storage account for a third-party application without exposing the account key, while still allowing public network access. In that case, a SAS with IP restrictions would be correct.
- ✗
Use a route table to force traffic to the storage account over the virtual network gateway.
Why it's wrong here
A route table only defines next-hop behavior for traffic, such as sending it through a virtual network gateway, but it does not change the storage account's addressing model. The storage service still uses a public IP address; forcing traffic through the gateway does not create a private IP in the VNet. Also, route tables cannot restrict access to the storage account from the internet, so the 'single VNet only' requirement remains unsatisfied.
When this WOULD be correct
If the requirement were to route traffic from on-premises to a storage account over a VPN or ExpressRoute, and public access was still allowed but restricted via firewall rules, a route table with a gateway could be used to force traffic through the virtual network gateway.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a private endpoint for the storage account and disable public network access.Correct answer▾
Why this is correct
A private endpoint places a private IP address in the VNet for the storage service, allowing traffic to stay on the private network path. Disabling public network access ensures the service cannot be reached through its public endpoint.
✗Configure a service endpoint on the subnet and keep public network access enabled.Wrong answer — click to see why▾
Why this is wrong here
A service endpoint does not assign a private IP to the storage account; it only provides direct connectivity from the subnet to the service over the Azure backbone. Public network access must be disabled to meet the requirement, but service endpoints do not disable public access.
★ When this WOULD be the correct answer
A service endpoint would be correct if the requirement was to allow access from a specific VNet without needing a private IP, and public network access could remain enabled for other sources (e.g., from on-premises via firewall rules).
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private connectivity, but service endpoints do not assign a private IP and do not disable public access.
✗Assign a shared access signature and rely on IP-based firewall rules.Wrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) provides time-limited access but does not disable public network access or assign a private IP. IP-based firewall rules still expose the storage account to the internet, failing the requirement for private IP and disabled public access.
★ When this WOULD be the correct answer
An administrator needs to grant temporary, delegated access to a storage account for a third-party application without exposing the account key, while still allowing public network access. In that case, a SAS with IP restrictions would be correct.
Why candidates choose this
Candidates may think SAS tokens combined with IP firewall rules can restrict access to a specific VNet, but they overlook that this still leaves the endpoint publicly resolvable and does not provide a private IP.
✗Use a route table to force traffic to the storage account over the virtual network gateway.Wrong answer — click to see why▾
Why this is wrong here
A route table forces traffic through a gateway but does not provide a private IP for the storage account within the VNet, nor does it disable public network access. It also cannot enforce that the storage account is reachable only from that VNet.
★ When this WOULD be the correct answer
If the requirement were to route traffic from on-premises to a storage account over a VPN or ExpressRoute, and public access was still allowed but restricted via firewall rules, a route table with a gateway could be used to force traffic through the virtual network gateway.
Why candidates choose this
Candidates may confuse network routing with private connectivity, thinking that forcing traffic through a gateway achieves the same isolation as a private endpoint, without understanding that a private endpoint provides a private IP and disables public access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.