AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account must be reachable only from resources in a specific Azure subnet, and connections must not use the public endpoint. Which option should the administrator configure?
⚠ Common exam trap
It's easy for candidates to confuse service endpoints with private endpoints, assuming both provide the same level of isolation, but service endpoints still expose the public endpoint and do not give a private IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint for the storage account in the subnet.
A private endpoint assigns the storage account a private IP address from the subnet, effectively bringing the service into the virtual network. This ensures all traffic to the storage account stays within the Microsoft Azure backbone and never traverses the public internet, meeting the requirement that connections must not use the public endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service endpoint on the subnet, because it keeps traffic on the Azure backbone.
Why it's wrong here
A service endpoint on the subnet still routes traffic to the storage account's public IP address. It only adds a source subnet identifier to the packet so the storage firewall can filter based on that source. This does not create a private network interface for the storage account, so the service is not reachable via a private IP exclusively from your subnet and remains exposed via the public endpoint. Thus, it does not satisfy the requirement for private, restricted access.
When this WOULD be correct
A service endpoint would be correct if the requirement was to restrict access to the storage account from a specific subnet while still allowing public endpoint access from other sources, and the goal was to optimize routing and keep traffic on the Azure backbone.
- ✓
A private endpoint for the storage account in the subnet.
Why this is correct
A private endpoint assigns the storage service a private IP address inside the selected virtual network subnet. Traffic then stays on private addressing instead of using the public endpoint, which is exactly what the requirement asks for. This also allows the administrator to restrict access to approved network locations while improving the security posture of the storage account.
- ✗
A NAT gateway attached to the subnet.
Why it's wrong here
A NAT gateway attached to the subnet controls outbound internet connectivity for VMs by translating their source addresses, but it has no effect on inbound traffic to a storage account. The storage account still uses its public endpoint, and no private IP is assigned to it for this networking path. A NAT gateway cannot block or allow inbound access to PaaS services; it is not a network access control mechanism for inbound service connections.
When this WOULD be correct
When the question asks how to provide outbound internet access to resources in a private subnet while hiding their private IPs behind a single public IP, a NAT gateway is the correct answer.
- ✗
A storage firewall rule that allows all Azure services.
Why it's wrong here
A firewall rule that allows all Azure services uses the storage account's public endpoint and permits connections from any Azure tenant or service, not just resources in your specific subnet. This rule, often implemented as 'Allow trusted Microsoft services', is far broader than the stated requirement. It does not restrict access to your VNet's private addressing and fails to guarantee that only resources from your subnet can reach the storage account.
When this WOULD be correct
This option would be correct if the question required allowing trusted Azure services (e.g., Azure Backup, Azure Logic Apps) to access the storage account while blocking all other public traffic, and the storage account's public endpoint is still used but restricted by firewall rules.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpoint for the storage account in the subnet.Correct answer▾
Why this is correct
A private endpoint assigns the storage service a private IP address inside the selected virtual network subnet. Traffic then stays on private addressing instead of using the public endpoint, which is exactly what the requirement asks for. This also allows the administrator to restrict access to approved network locations while improving the security posture of the storage account.
✗A service endpoint on the subnet, because it keeps traffic on the Azure backbone.Wrong answer — click to see why▾
Why this is wrong here
A service endpoint does not prevent public endpoint access; it only ensures traffic from the subnet to the storage account stays on the Azure backbone, but the storage account still has a public endpoint that could be accessed from elsewhere.
★ When this WOULD be the correct answer
A service endpoint would be correct if the requirement was to restrict access to the storage account from a specific subnet while still allowing public endpoint access from other sources, and the goal was to optimize routing and keep traffic on the Azure backbone.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both eliminate public exposure, but service endpoints only provide a direct route without removing the public endpoint.
✗A NAT gateway attached to the subnet.Wrong answer — click to see why▾
Why this is wrong here
A NAT gateway enables outbound internet connectivity for private subnets but does not restrict inbound access to the storage account from a specific subnet, nor does it eliminate the public endpoint.
★ When this WOULD be the correct answer
When the question asks how to provide outbound internet access to resources in a private subnet while hiding their private IPs behind a single public IP, a NAT gateway is the correct answer.
Why candidates choose this
Candidates may confuse NAT gateway with network isolation features, thinking it can replace private endpoints for securing inbound traffic to Azure services.
✗A storage firewall rule that allows all Azure services.Wrong answer — click to see why▾
Why this is wrong here
A storage firewall rule allowing all Azure services permits connections from any Azure service, not just from the specific subnet, and still uses the public endpoint, failing to meet the requirement of no public endpoint access.
★ When this WOULD be the correct answer
This option would be correct if the question required allowing trusted Azure services (e.g., Azure Backup, Azure Logic Apps) to access the storage account while blocking all other public traffic, and the storage account's public endpoint is still used but restricted by firewall rules.
Why candidates choose this
Candidates may think that allowing all Azure services is a simple way to restrict access to Azure resources, overlooking that it does not limit traffic to a specific subnet and still uses the public endpoint.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.