AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account must be reachable only from resources in a single VNet. The team wants the storage service to use a private IP address inside that VNet and wants to disable public network access. Which feature should be configured?
⚠ Common exam trap
Watch out — candidates often confuse service endpoints with private endpoints, assuming both provide private IP addresses, but service endpoints only provide a direct route over the Microsoft backbone while still using the public endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint
A private endpoint assigns the storage account a private IP address from the VNet's address space, effectively bringing the service into the VNet. It also disables public network access by default when configured with the 'Deny public network access' setting, ensuring the storage account is reachable only from within that VNet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service endpoint
Why it's wrong here
A service endpoint adds a direct, optimized route from your subnet to the storage service's public IP address, but the storage account remains on its public endpoint and is not assigned a private IP in your VNet. Service endpoints do not, by themselves, limit access to a single VNet; you still must use separate firewall rules to restrict traffic. They reduce network latency and improve security by bypassing the internet for packets from your VNet, yet the service itself is not given a private identity.
When this WOULD be correct
A service endpoint would be correct if the question asked for a way to secure storage account access to a specific VNet without requiring a private IP, and public network access could remain enabled but restricted to that VNet's traffic.
- ✓
A private endpoint
Why this is correct
A private endpoint assigns the storage account a private IP address from your virtual network, so the service is reachable only via that private IP from resources in the VNet. This effectively moves the storage endpoint into your VNet and eliminates exposure to the public internet. Traffic to the storage account flows over the Microsoft backbone, not the public internet, and can be further secured with network policies.
- ✗
A network security group rule on the subnet
Why it's wrong here
A network security group (NSG) rule on the subnet controls traffic to and from virtual machines and other resources within that subnet; it does not apply to the storage account itself because the storage service is a PaaS resource outside your VNet. An NSG cannot grant or deny access to the storage service's endpoint; it only filters traffic among resources in the subnet. Thus, an NSG rule cannot make the storage account reachable only from your VNet, since it has no effect on traffic destined to the external storage service.
When this WOULD be correct
An NSG rule on the subnet would be correct in a scenario where the storage account uses a service endpoint (public endpoint) and the goal is to restrict inbound traffic to the storage account from only that subnet, while still allowing public access from other sources if needed. For example, 'You need to allow a specific subnet to access an Azure Storage account that uses a service endpoint, and deny all other traffic to that storage account.'
- ✗
A storage account firewall IP allow rule
Why it's wrong here
A storage account firewall IP allow rule is an access control on the storage service's public endpoint that lets you specify allowed public IP address ranges. It does not create a private IP address or place the service in your VNet; the storage account still has a public endpoint and is reachable from the internet from the allowed IPs. This rule only filters inbound traffic; it does not provide private connectivity or make the service reachable only from your VNet.
When this WOULD be correct
When the requirement is to allow access to a storage account only from specific public IP addresses or ranges (e.g., from an on-premises network with a static public IP) while still keeping public endpoint enabled.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpointCorrect answer▾
Why this is correct
A private endpoint assigns the storage account a private IP address from your virtual network, so the service is reachable only via that private IP from resources in the VNet. This effectively moves the storage endpoint into your VNet and eliminates exposure to the public internet. Traffic to the storage account flows over the Microsoft backbone, not the public internet, and can be further secured with network policies.
✗A service endpointWrong answer — click to see why▾
Why this is wrong here
A service endpoint does not assign a private IP to the storage account; it only allows access from a VNet while the storage account retains its public endpoint. The question requires the storage service to use a private IP inside the VNet, which only a private endpoint provides.
★ When this WOULD be the correct answer
A service endpoint would be correct if the question asked for a way to secure storage account access to a specific VNet without requiring a private IP, and public network access could remain enabled but restricted to that VNet's traffic.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private connectivity, but service endpoints do not assign a private IP and still expose the public endpoint.
✗A network security group rule on the subnetWrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) rule on the subnet can filter traffic to the storage account's public endpoint, but it does not provide a private IP address for the storage service nor disable public network access. The storage account would still be accessible via its public endpoint from outside the VNet if the NSG rule is misconfigured or bypassed.
★ When this WOULD be the correct answer
An NSG rule on the subnet would be correct in a scenario where the storage account uses a service endpoint (public endpoint) and the goal is to restrict inbound traffic to the storage account from only that subnet, while still allowing public access from other sources if needed. For example, 'You need to allow a specific subnet to access an Azure Storage account that uses a service endpoint, and deny all other traffic to that storage account.'
Why candidates choose this
Candidates may confuse NSG rules with private endpoints because both can restrict network access. They might think that an NSG rule on the subnet can provide private IP connectivity and disable public access, not realizing that NSGs only filter traffic to the public endpoint and do not change the endpoint type.
✗A storage account firewall IP allow ruleWrong answer — click to see why▾
Why this is wrong here
A storage account firewall IP allow rule restricts access based on public IP addresses, not private IPs within a VNet. It cannot provide a private IP address inside the VNet or disable public network access entirely.
★ When this WOULD be the correct answer
When the requirement is to allow access to a storage account only from specific public IP addresses or ranges (e.g., from an on-premises network with a static public IP) while still keeping public endpoint enabled.
Why candidates choose this
Candidates may confuse IP-based firewall rules with network-level access controls, thinking that allowing specific IPs can restrict access to a VNet, but it does not provide private IP connectivity or disable public access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Private IP address
A private IP address is a non-internet-routable address used within a local network to identify devices and allow them to communicate with each other without direct exposure to the public internet.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.