AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account must be reachable only from a single subnet. The team wants to keep the storage public endpoint in place, avoid a private endpoint, and avoid managing any custom DNS records. Which change best meets the requirement?
⚠ Common exam trap
Many candidates confuse network security groups (NSGs) with storage account firewalls, thinking an NSG rule on the subnet can restrict access to the storage account, when in fact the storage account firewall must explicitly allow the subnet via a service endpoint or virtual network rule to enforce subnet-level restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.
Enabling a service endpoint for Microsoft.Storage on the subnet injects the subnet's identity into the traffic to the storage account, allowing the storage account firewall to permit access only from that subnet while keeping the public endpoint active. This avoids the need for a private endpoint, custom DNS records, or additional routing appliances, directly meeting the requirement of restricting access to a single subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.
Why it's wrong here
An NSG rule permitting outbound TCP 443 to the Microsoft.Storage service tag only filters what leaves the subnet; it has no effect on the storage account's own network access controls. The storage account's firewall remains open to every public IP unless you explicitly add allow or deny rules there, so traffic from other subnets or from on-premises is still accepted. Moreover, allowing outbound traffic cannot tell the PaaS service to reject requests from other sources, because authorization is enforced at the resource boundary, not at the client subnet boundary.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to ensure that virtual machines in a subnet can securely access a storage account over the internet, but the storage account itself is not required to be restricted to that subnet. For example, if the question asked 'How to allow outbound HTTPS traffic from a subnet to a storage account?'
- ✓
Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.
Why this is correct
This is the correct approach when the service must remain on the public endpoint but be accessible only from a specific subnet. The service endpoint lets Azure recognize the subnet as an allowed source while traffic still uses the storage account's public FQDN. Adding that subnet to the storage firewall enforces the restriction without requiring private endpoints or custom DNS management.
- ✗
Create a private endpoint and set the storage account to use a private DNS zone.
Why it's wrong here
While a private endpoint with a private DNS zone would strictly limit access to the subnet by giving the storage account a private IP in that subnet, this solution is explicitly ruled out by the requirement's constraint against private endpoints and custom DNS management. It also removes the public endpoint and requires managing a private DNS zone's lifecycle and VNet links, which is more operational overhead than the standard subnet-based service endpoint. Even though it would work technically, it is not the expected answer because the question asks for the simplest subnet-scoped control, not a private connectivity architecture.
When this WOULD be correct
When the requirement is to ensure the storage account is not accessible from the public internet at all, and the organization can manage private DNS zones (e.g., for compliance or security reasons).
- ✗
Create a route table that sends storage traffic through an Azure Firewall appliance.
Why it's wrong here
A route table sending storage traffic to an Azure Firewall appliance changes the network path and may apply inspection/filtering, but it does not configure the storage account to accept traffic only from the protected subnet. The firewall would have to identify and allow the exact source, yet the storage account's public endpoint would still be reachable from any other location unless you also manipulate its firewall rules. Native subnet isolation is achieved with a service endpoint or private endpoint; a UDR alone neither authorizes a subnet nor satisfies the PaaS-layer access restriction.
When this WOULD be correct
This option would be correct in a scenario where the organization requires centralized inspection and logging of all outbound traffic to storage accounts for security compliance, and the storage account must be accessed via a specific firewall IP address rather than directly from the subnet.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.Correct answer▾
Why this is correct
This is the correct approach when the service must remain on the public endpoint but be accessible only from a specific subnet. The service endpoint lets Azure recognize the subnet as an allowed source while traffic still uses the storage account's public FQDN. Adding that subnet to the storage firewall enforces the restriction without requiring private endpoints or custom DNS management.
✗Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.Wrong answer — click to see why▾
Why this is wrong here
An NSG rule on the subnet does not restrict inbound access to the storage account from the internet; it only controls outbound traffic from the subnet. The storage account's public endpoint remains open to all networks unless explicitly restricted by the storage firewall.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to ensure that virtual machines in a subnet can securely access a storage account over the internet, but the storage account itself is not required to be restricted to that subnet. For example, if the question asked 'How to allow outbound HTTPS traffic from a subnet to a storage account?'
Why candidates choose this
Candidates may think that an NSG rule can restrict access to the storage account because NSGs are commonly used to control network traffic, but they overlook that NSGs apply to the subnet's traffic, not to the storage account's inbound access control.
✗Create a private endpoint and set the storage account to use a private DNS zone.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly requires keeping the public endpoint and avoiding a private endpoint, so creating a private endpoint directly violates the constraints.
★ When this WOULD be the correct answer
When the requirement is to ensure the storage account is not accessible from the public internet at all, and the organization can manage private DNS zones (e.g., for compliance or security reasons).
Why candidates choose this
Candidates may think private endpoints are the only way to restrict access to a single subnet, overlooking service endpoints as a simpler alternative that keeps the public endpoint.
✗Create a route table that sends storage traffic through an Azure Firewall appliance.Wrong answer — click to see why▾
Why this is wrong here
This option introduces unnecessary complexity and cost by routing traffic through an Azure Firewall, which does not directly restrict access to the storage account from a single subnet. The requirement is to keep the public endpoint and avoid private endpoints, but a firewall does not replace the need for network-level access control on the storage account itself.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the organization requires centralized inspection and logging of all outbound traffic to storage accounts for security compliance, and the storage account must be accessed via a specific firewall IP address rather than directly from the subnet.
Why candidates choose this
Candidates may think that using Azure Firewall provides a secure, controlled way to restrict access, similar to a network security group, but they overlook that the question explicitly wants to avoid managing custom DNS records and keep the public endpoint, which a firewall does not address.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Service endpoint
A service endpoint is a specific network address (URL or IP/port) that client applications use to access the functionality or data of a cloud or web service.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.