AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account must remain reachable through its public endpoint for an on-premises integration server, but only one Azure subnet should be allowed to access it from Azure. The team does not want private endpoints or DNS changes. What should the administrator configure?
⚠ Common exam trap
Watch out — candidates often confuse service endpoints with private endpoints, assuming that service endpoints require disabling public access or that private endpoints are the only way to restrict subnet access, when in fact service endpoints allow selective subnet access while keeping the public endpoint active.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a service endpoint on the subnet and add that subnet to the storage account networking rules
A service endpoint extends the virtual network identity to the storage account, allowing you to restrict access to a specific subnet while keeping the public endpoint enabled for on-premises access. This meets the requirement of allowing only one Azure subnet to access the storage account from Azure without using private endpoints or DNS changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a private endpoint and disable public network access
Why it's wrong here
Deploying a private endpoint and disabling public network access would sever the storage account's public endpoint entirely, leaving only a private IP address reachable from within the virtual network. The on-premises integration server is not inside that VNet and relies on the public endpoint, so it would lose connectivity completely. This approach directly contradicts the requirement that the storage account remain reachable through its public endpoint for that server. The correct solution keeps the public endpoint active and uses a service endpoint to restrict Azure-side access.
When this WOULD be correct
When the requirement is to completely remove public internet access and only allow private connectivity from a specific Azure subnet, without needing public endpoint access for on-premises resources.
- ✓
Enable a service endpoint on the subnet and add that subnet to the storage account networking rules
Why this is correct
A service endpoint lets traffic from the chosen Azure subnet reach the storage account over the Microsoft backbone while still using the account's public endpoint. Adding the subnet to the storage account firewall rules then restricts Azure access to only that subnet. This meets the requirement to keep public access available for the on-premises integration server while tightly limiting Azure-based access without private endpoints or DNS changes.
- ✗
Create a SAS token restricted to that subnet
Why it's wrong here
A SAS token is an authorization mechanism that grants scoped access to storage data operations, but it cannot enforce network-level source restrictions. Even when a SAS includes allowed IP ranges, those ranges map to individual egress IPs, not to an Azure virtual network subnet, and the on-premises server's traffic would have no subnet identifier. To restrict traffic by subnet, you must apply a service endpoint or a VNet rule in the storage account firewall, which operates before any SAS-based authorization. Therefore, a SAS token is insufficient for meeting the subnet-specific public access requirement.
When this WOULD be correct
When the requirement is to grant time-limited, delegated access to a specific storage resource (e.g., a blob or container) without changing network rules, and the client can securely manage the token. For example, allowing a third-party application to upload files for 1 hour.
- ✗
Assign Storage Blob Data Reader to the subnet
Why it's wrong here
Role-based access control (RBAC) assignments such as Storage Blob Data Reader are applied to security principals (users, groups, service principals, or managed identities), not to subnets or other network resources. Additionally, this role grants read permissions to blob data but does not impose any network-origin restriction; it only authorizes an identity once the request reaches the storage account. Without a network rule, traffic from the subnet would be allowed based on identity, but traffic from other networks could also be allowed if the identity has permission. This option fails both because it cannot be assigned to a subnet and because it does not enforce the required network-level isolation.
When this WOULD be correct
This option would be correct if the question required granting read-only permissions to blob data for resources in a specific subnet, without needing to restrict network access (e.g., when the storage account already has a service endpoint or private endpoint configured).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a service endpoint on the subnet and add that subnet to the storage account networking rulesCorrect answer▾
Why this is correct
A service endpoint lets traffic from the chosen Azure subnet reach the storage account over the Microsoft backbone while still using the account's public endpoint. Adding the subnet to the storage account firewall rules then restricts Azure access to only that subnet. This meets the requirement to keep public access available for the on-premises integration server while tightly limiting Azure-based access without private endpoints or DNS changes.
✗Add a private endpoint and disable public network accessWrong answer — click to see why▾
Why this is wrong here
A private endpoint disables public endpoint access, but the question requires the storage account to remain reachable through its public endpoint for the on-premises server.
★ When this WOULD be the correct answer
When the requirement is to completely remove public internet access and only allow private connectivity from a specific Azure subnet, without needing public endpoint access for on-premises resources.
Why candidates choose this
Candidates may think private endpoint is the only way to restrict access to a specific subnet, overlooking that service endpoints can achieve subnet-level restriction while keeping the public endpoint enabled.
✗Create a SAS token restricted to that subnetWrong answer — click to see why▾
Why this is wrong here
A SAS token restricts access to specific resources or operations, not network-level access. It cannot enforce that traffic originates from a specific subnet; the SAS token can be used from any IP address that has the token.
★ When this WOULD be the correct answer
When the requirement is to grant time-limited, delegated access to a specific storage resource (e.g., a blob or container) without changing network rules, and the client can securely manage the token. For example, allowing a third-party application to upload files for 1 hour.
Why candidates choose this
Candidates may think SAS tokens can restrict access by source IP or subnet because SAS can include an allowed IP range, but that range is for the client's public IP, not an Azure subnet, and it does not replace network-level subnet restrictions.
✗Assign Storage Blob Data Reader to the subnetWrong answer — click to see why▾
Why this is wrong here
Assigning Storage Blob Data Reader to the subnet grants read access to blob data but does not control network access; the storage account's public endpoint would still be accessible from any IP, violating the requirement to restrict access to only one Azure subnet.
★ When this WOULD be the correct answer
This option would be correct if the question required granting read-only permissions to blob data for resources in a specific subnet, without needing to restrict network access (e.g., when the storage account already has a service endpoint or private endpoint configured).
Why candidates choose this
Candidates may confuse role-based access control (RBAC) with network-level access restrictions, thinking that assigning a role to a subnet can limit network connectivity, when in fact RBAC only controls data plane permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A storage account must be reachable only from a single subnet. The team wants to keep the storage public endpoint in place, avoid a private endpoint, and avoid managing any custom DNS records. Which change best meets the requirement?
hard- A.Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.
- ✓ B.Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.
- C.Create a private endpoint and set the storage account to use a private DNS zone.
- D.Create a route table that sends storage traffic through an Azure Firewall appliance.
Why B: Enabling a service endpoint for Microsoft.Storage on the subnet injects the subnet's identity into the traffic to the storage account, allowing the storage account firewall to permit access only from that subnet while keeping the public endpoint active. This avoids the need for a private endpoint, custom DNS records, or additional routing appliances, directly meeting the requirement of restricting access to a single subnet.
Variation 2. A storage account must be reachable only from one subnet. The team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with the storage account continuing to use its public endpoint. Which feature should be configured on the subnet?
medium- A.A private endpoint for the storage account
- ✓ B.A service endpoint for Microsoft.Storage
- C.A route table with a default route to the storage account
- D.An application security group containing the subnet
Why B: A service endpoint for Microsoft.Storage allows a subnet to restrict access to a storage account's public endpoint without deploying a private endpoint or managing private DNS zones. When enabled, Azure adds the subnet's identity to traffic from that subnet, and the storage account's firewall can be configured to allow only that specific subnet, keeping the public endpoint active.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.