AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account must remain on its public endpoint, but only one Azure subnet named AppSubnet should be allowed to access it from Azure. No private IP is required. Which two actions should the administrator take? Select two.
⚠ Common exam trap
Test-takers frequently confuse service endpoints with private endpoints, assuming that restricting access to a single subnet requires a private IP and disabling public access, when in fact service endpoints achieve the same goal without changing the endpoint type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Microsoft.Storage service endpoint on AppSubnet.
Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, using the public endpoint while restricting access to only that subnet. Option B is correct because configuring the storage account's networking firewall to allow the selected virtual network and subnet explicitly permits traffic from AppSubnet while blocking all other public access, meeting the requirement to keep the public endpoint but limit access to one subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the Microsoft.Storage service endpoint on AppSubnet.
Why this is correct
Enabling the Microsoft.Storage service endpoint on AppSubnet adds that subnet's identity to the storage service's network policy. Service endpoints do not change the storage account's public DNS or IP address; instead, they ensure traffic from AppSubnet is tagged with the virtual network and subnet source. This tag allows the storage firewall's virtual network rule to match the request, effectively permitting access through the existing public endpoint.
- ✓
Configure the storage account networking firewall to allow the selected virtual network and subnet.
Why this is correct
The storage account firewall's default deny-all rule must be overridden with an explicit allow rule tied to the virtual network and subnet that have the service endpoint enabled. Adding a virtual network rule in the networking firewall identifies traffic originating from AppSubnet and permits it to reach the storage account over its public endpoint. Without this rule, the service endpoint alone would not grant access, and without the endpoint, the firewall rule could not match the subnet.
- ✗
Create a private endpoint and disable public network access.
Why it's wrong here
Deploying a private endpoint assigns the storage account a private IP address from AppSubnet, which requires disabling the public endpoint for full effect. The question explicitly states the account must remain on its public endpoint, so this would violate the requirement. Even if a private endpoint were created, disabling public internet access would block the public endpoint entirely, making it the wrong architectural choice.
When this WOULD be correct
When the requirement is to access the storage account privately from a virtual network without exposing it to the public internet, such as in a scenario where you need to ensure all traffic stays within the Azure backbone and avoid public endpoints for security compliance.
- ✗
Link a private DNS zone to AppSubnet.
Why it's wrong here
Linking a private DNS zone to AppSubnet only changes how DNS names resolve within that subnet, mapping the storage account's FQDN to a private IP address. It does not modify storage firewall rules or service endpoints, so it cannot control which network paths are permitted to reach the storage account. Since no private endpoint is being used, the private DNS zone would have no effect on public endpoint access.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to access the storage account privately from a virtual network, eliminating exposure to the public internet. For example, if the question stated 'The storage account must not be accessible from the public internet and must be accessed privately from AppSubnet,' then creating a private endpoint and linking a private DNS zone would be appropriate.
- ✗
Assign the Reader RBAC role to AppSubnet.
Why it's wrong here
Subnets are not Azure AD security principals, so they cannot be assigned a Reader role; role assignments apply to users, groups, service principals, or managed identities. Even if a role were assigned at the virtual network level, the Reader role grants Azure Resource Manager read access, not permission to bypass network filtering on the storage account's data path. Network access is controlled by the storage firewall and service endpoints, not by RBAC authorization.
When this WOULD be correct
This option would be correct in a scenario where the question asks for granting read-only permissions to a subnet's resources (e.g., VMs) to access the storage account data plane, without needing network restrictions. For example: 'You need to allow VMs in AppSubnet to list storage account containers. Which RBAC role should you assign?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable the Microsoft.Storage service endpoint on AppSubnet.Correct answer▾
Why this is correct
Enabling the Microsoft.Storage service endpoint on AppSubnet adds that subnet's identity to the storage service's network policy. Service endpoints do not change the storage account's public DNS or IP address; instead, they ensure traffic from AppSubnet is tagged with the virtual network and subnet source. This tag allows the storage firewall's virtual network rule to match the request, effectively permitting access through the existing public endpoint.
✗Create a private endpoint and disable public network access.Wrong answer — click to see why▾
Why this is wrong here
The question requires keeping the storage account on its public endpoint and allowing only one subnet. Creating a private endpoint and disabling public network access would remove the public endpoint, contradicting the requirement.
★ When this WOULD be the correct answer
When the requirement is to access the storage account privately from a virtual network without exposing it to the public internet, such as in a scenario where you need to ensure all traffic stays within the Azure backbone and avoid public endpoints for security compliance.
Why candidates choose this
Candidates may confuse private endpoint with service endpoint, or think that private endpoint is the only way to restrict access to a specific subnet, not realizing that service endpoints with firewall rules can achieve the same without removing the public endpoint.
✗Link a private DNS zone to AppSubnet.Wrong answer — click to see why▾
Why this is wrong here
The question requires the storage account to remain on its public endpoint and does not require a private IP. Creating a private endpoint and linking a private DNS zone would move the storage account to a private endpoint, which contradicts the requirement to keep the public endpoint.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to access the storage account privately from a virtual network, eliminating exposure to the public internet. For example, if the question stated 'The storage account must not be accessible from the public internet and must be accessed privately from AppSubnet,' then creating a private endpoint and linking a private DNS zone would be appropriate.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking that a private endpoint is needed to restrict access to a specific subnet, or they may assume that a private DNS zone is always required for secure access from a subnet.
✗Assign the Reader RBAC role to AppSubnet.Wrong answer — click to see why▾
Why this is wrong here
The Reader RBAC role grants read-only access to Azure resources but does not control network access to the storage account. It cannot restrict access to a specific subnet; network firewalls or service endpoints are required for that purpose.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks for granting read-only permissions to a subnet's resources (e.g., VMs) to access the storage account data plane, without needing network restrictions. For example: 'You need to allow VMs in AppSubnet to list storage account containers. Which RBAC role should you assign?'
Why candidates choose this
Candidates may confuse RBAC roles with network access controls, thinking that assigning a role to a subnet can restrict or allow access from that subnet, when in fact RBAC governs identity-based permissions, not network-level filtering.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Service endpoint
A service endpoint is a specific network address (URL or IP/port) that client applications use to access the functionality or data of a cloud or web service.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.