AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account must be reachable only from one Azure virtual network. The team wants the storage service to have a private IP in that VNet, public network access disabled, and name resolution to work without using the public endpoint. What should the administrator configure?
⚠ Common exam trap
Many exam-takers confuse service endpoints with private endpoints, assuming a service endpoint provides a private IP and disables public access, when in fact it only routes traffic over the Microsoft backbone while still using the public endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint and a private DNS zone linked to the VNet
A private endpoint assigns the storage account a private IP from the VNet's address space, making it reachable only within that VNet. Disabling public network access ensures no traffic can reach the storage account via its public endpoint. A private DNS zone linked to the VNet enables name resolution to resolve the storage account's FQDN to the private IP without using the public endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service endpoint on the subnet and a storage firewall rule
Why it's wrong here
A service endpoint on a subnet plus a storage firewall rule provides a limited network route from that subnet to the storage account, but it does not assign a private IP address to the storage account inside the VNet. The storage account continues using its public endpoint; the firewall rule works by matching the subnet's source IP, and the service is still reachable via the public DNS name from other networks if rules are misconfigured. Without a private IP and private DNS, the storage account is not truly private to the VNet, which is exactly what a private endpoint delivers.
When this WOULD be correct
This option would be correct if the requirement was to restrict access to the storage account from a specific VNet while still using the public endpoint, and the team did not need a private IP or to disable public network access entirely.
- ✓
A private endpoint and a private DNS zone linked to the VNet
Why this is correct
A private endpoint places a private IP address for the storage service in the VNet, and the private DNS zone ensures the service name resolves to that private IP. Together, they provide private access while allowing public network access to be disabled.
- ✗
A public IP address and IP-based firewall exceptions
Why it's wrong here
Assigning a public IP and configuring IP-based firewall rules still leaves the storage account's public endpoint exposed to the internet; the firewall merely limits which public source IPs can reach it. Traffic from allowed IPs traverses the public internet, and the service name still resolves to a public address, so the account is not confined to a specific virtual network. This approach provides network-level filtering, not network isolation, and fails the 'reachable only from one VNet' requirement.
When this WOULD be correct
This option would be correct if the question required allowing access from a specific set of public IP addresses (e.g., on-premises or remote locations) while still using the public endpoint, and there was no requirement for private IP or disabling public access.
- ✗
A shared access signature and blob container ACLs
Why it's wrong here
A shared access signature (SAS) and blob container ACLs are authorization controls that govern who can read, write, or list blobs, not how the storage account is reached. Neither mechanism changes the network access path: the storage account remains publicly resolvable and reachable from anywhere unless additional network rules are applied. These tools determine identity/credential-based access, but they cannot place the service inside a VNet or block external connectivity.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to grant time-limited, delegated access to specific blobs or containers for external users or applications, while still using the public endpoint. For example, 'A storage account must allow temporary read access to a specific blob for an external partner without sharing the account key.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpoint and a private DNS zone linked to the VNetCorrect answer▾
Why this is correct
A private endpoint places a private IP address for the storage service in the VNet, and the private DNS zone ensures the service name resolves to that private IP. Together, they provide private access while allowing public network access to be disabled.
✗A service endpoint on the subnet and a storage firewall ruleWrong answer — click to see why▾
Why this is wrong here
A service endpoint and firewall rule do not assign a private IP to the storage account; the service endpoint only provides source IP restriction from the VNet, and the storage account still uses its public endpoint, failing the requirement for a private IP and disabled public network access.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to restrict access to the storage account from a specific VNet while still using the public endpoint, and the team did not need a private IP or to disable public network access entirely.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking that a service endpoint provides private connectivity, or they may believe that a firewall rule alone can make the storage account unreachable from the internet.
✗A public IP address and IP-based firewall exceptionsWrong answer — click to see why▾
Why this is wrong here
Option C suggests using a public IP and IP-based firewall exceptions, but the requirement is to disable public network access and use a private IP within the VNet. Public IP and firewall rules still expose the storage account to the internet, violating the 'public network access disabled' condition.
★ When this WOULD be the correct answer
This option would be correct if the question required allowing access from a specific set of public IP addresses (e.g., on-premises or remote locations) while still using the public endpoint, and there was no requirement for private IP or disabling public access.
Why candidates choose this
Candidates may think that restricting access via IP firewall rules is sufficient to secure the storage account, overlooking the need for a private IP and complete removal of public endpoint access as specified in the question.
✗A shared access signature and blob container ACLsWrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) and blob container ACLs provide granular access control and temporary delegated access, but they do not restrict network access to a single VNet, assign a private IP, or disable the public endpoint. They operate over the public endpoint and do not meet the requirement for private network integration.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to grant time-limited, delegated access to specific blobs or containers for external users or applications, while still using the public endpoint. For example, 'A storage account must allow temporary read access to a specific blob for an external partner without sharing the account key.'
Why candidates choose this
Candidates may confuse access control mechanisms (SAS, ACLs) with network-level security controls, thinking that restricting access via SAS and ACLs can replace the need for network isolation and private IP assignment.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Private DNS zone
A private DNS zone is a hosted DNS namespace that is only resolvable from within specific virtual networks or private environments, not from the public internet.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants an Azure Storage account to be reachable privately from a virtual network. Which two statements about a private endpoint are correct? Select two.
easy- ✓ A.The storage service gets a private IP address in the selected virtual network.
- B.The virtual machine that reaches the service must have its own public IP address.
- C.A private endpoint replaces the need for any DNS configuration.
- ✓ D.A private DNS zone is commonly used so the service name resolves to the private IP.
- E.A private endpoint and a service endpoint are the same feature.
Why A: A private endpoint assigns the Azure Storage service a private IP address from the subnet of the selected virtual network, effectively bringing the service into the VPC-like environment. This ensures that traffic to the storage account stays within the Microsoft backbone network and never traverses the public internet, meeting private connectivity requirements.
Variation 2. A storage account must be reachable only from resources in one Azure subnet, and traffic must use a private IP rather than the public endpoint. Which configuration should the administrator implement?
easy- A.A service endpoint on the subnet
- ✓ B.A private endpoint in the subnet
- C.A shared access signature scoped to the subnet
- D.Allow trusted Microsoft services on the storage firewall
Why B: A private endpoint assigns a private IP address from the subnet to the storage account, making it accessible only via that private IP within the virtual network. This ensures traffic never traverses the public endpoint, meeting both the reachability and private IP requirements.
Variation 3. A storage account must be reachable only from a single Azure VNet. The team wants the storage account to have a private IP in that VNet and wants to disable public network access. Which solution should the administrator implement?
medium- A.Configure a service endpoint on the subnet and keep public network access enabled.
- ✓ B.Create a private endpoint for the storage account and disable public network access.
- C.Assign a shared access signature and rely on IP-based firewall rules.
- D.Use a route table to force traffic to the storage account over the virtual network gateway.
Why B: A private endpoint assigns the storage account a private IP from the VNet, making it accessible only within that VNet over a private connection. Disabling public network access ensures no traffic can reach the storage account from the internet, meeting both requirements. This is the only option that provides a private IP and blocks all public access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.