AZ-104 Implement and Manage Storage Practice Question
A storage account must stay reachable through its public endpoint, but only Azure workloads in AppSubnet should be allowed to access it. No private IP is required. What should you configure?
⚠ Common exam trap
Candidates often confuse private endpoints (which remove public endpoint access) with service endpoints (which preserve public endpoint access while restricting traffic), leading them to choose the private endpoint option despite the explicit requirement to keep the public endpoint reachable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service endpoint on AppSubnet and a storage firewall VNet rule.
A service endpoint on AppSubnet extends the Azure backbone network to the subnet, allowing traffic to the storage account's public endpoint without a private IP. The storage firewall VNet rule then restricts access to only traffic originating from that specific subnet, meeting the requirement of public endpoint reachability with Azure workload-only access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A private endpoint in AppSubnet.
Why it's wrong here
A private endpoint assigns the storage account a private IP address from AppSubnet, effectively moving access onto a private network path and requiring DNS changes to redirect traffic away from the public endpoint. This contradicts the requirement that the storage account 'stay reachable through its public endpoint,' because once a private endpoint is configured, you typically disable public access to fully isolate the resource. Even if public access is left on, the private endpoint adds unnecessary complexity and does not purely restrict the existing public endpoint to a specific subnet.
When this WOULD be correct
If the question required that the storage account should not be accessible via the public endpoint at all, and only be reachable from AppSubnet using a private IP, then a private endpoint in AppSubnet would be the correct configuration.
- ✓
A service endpoint on AppSubnet and a storage firewall VNet rule.
Why this is correct
A service endpoint on AppSubnet routes traffic from that subnet to the storage account over the Microsoft backbone while still using the storage account's public endpoint. Adding a corresponding storage firewall VNet rule restricts access so that only requests originating from AppSubnet are allowed, even though the public endpoint remains reachable. This combination satisfies the requirement because the URL/endpoint does not change and no private IP address is introduced, while the firewall rule provides access control based on the subnet's virtual network identity.
- ✗
A VPN gateway between AppSubnet and the storage account.
Why it's wrong here
A VPN gateway provides encrypted connectivity between an on-premises network or remote site and an Azure virtual network through a gateway subnet. It does not control access to a PaaS storage account's public endpoint; without a separate service endpoint or firewall rule, the storage account remains open to all public internet traffic. Additionally, a VPN gateway would require a gateway subnet and a site-to-site or point-to-site configuration, which is overkill and does not scope access to a single application subnet like AppSubnet.
When this WOULD be correct
A VPN gateway would be correct if the question required connecting an on-premises network to Azure to access a storage account securely over the internet, or if the storage account needed to be accessed from a remote network without using the public internet.
- ✗
A public IP address on the storage account.
Why it's wrong here
Azure Storage is a platform-as-a-service resource that cannot have a customer-assigned public IP address attached to it; the service is published via a Microsoft-managed public endpoint. Storage firewalls restrict access through network rules based on source IP addresses, virtual network subnets, or service tags—not by assigning a public IP to the storage account. Therefore, adding a public IP address is not a valid mechanism for scoping access and would not achieve subnet-level restriction.
When this WOULD be correct
If the question asked for a way to make a storage account accessible via a specific public IP address from on-premises or another cloud, and the storage account firewall allowed that IP, then configuring a public IP (e.g., on a VM or VPN device) could be part of the solution. However, Azure storage accounts do not have a configurable public IP address.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A service endpoint on AppSubnet and a storage firewall VNet rule.Correct answer▾
Why this is correct
A service endpoint on AppSubnet routes traffic from that subnet to the storage account over the Microsoft backbone while still using the storage account's public endpoint. Adding a corresponding storage firewall VNet rule restricts access so that only requests originating from AppSubnet are allowed, even though the public endpoint remains reachable. This combination satisfies the requirement because the URL/endpoint does not change and no private IP address is introduced, while the firewall rule provides access control based on the subnet's virtual network identity.
✗A private endpoint in AppSubnet.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint assigns a private IP to the storage account, which contradicts the requirement that 'no private IP is required' and that the storage account must stay reachable through its public endpoint.
★ When this WOULD be the correct answer
If the question required that the storage account should not be accessible via the public endpoint at all, and only be reachable from AppSubnet using a private IP, then a private endpoint in AppSubnet would be the correct configuration.
Why candidates choose this
Candidates may confuse private endpoints with service endpoints, thinking both provide secure access from a subnet, but private endpoints remove public access and assign a private IP, which is not needed here.
✗A VPN gateway between AppSubnet and the storage account.Wrong answer — click to see why▾
Why this is wrong here
A VPN gateway is used for site-to-site or point-to-site connectivity over the internet, not for allowing Azure workloads in a subnet to access a storage account via its public endpoint. It adds unnecessary complexity and cost, and does not provide the required network-level access control.
★ When this WOULD be the correct answer
A VPN gateway would be correct if the question required connecting an on-premises network to Azure to access a storage account securely over the internet, or if the storage account needed to be accessed from a remote network without using the public internet.
Why candidates choose this
Candidates might think a VPN gateway is needed to securely connect a subnet to a storage account, confusing it with scenarios where private connectivity is required across networks.
✗A public IP address on the storage account.Wrong answer — click to see why▾
Why this is wrong here
The storage account already has a public endpoint; assigning a public IP address is not a configuration option for Azure storage accounts and does not restrict access to AppSubnet.
★ When this WOULD be the correct answer
If the question asked for a way to make a storage account accessible via a specific public IP address from on-premises or another cloud, and the storage account firewall allowed that IP, then configuring a public IP (e.g., on a VM or VPN device) could be part of the solution. However, Azure storage accounts do not have a configurable public IP address.
Why candidates choose this
Candidates may think that assigning a public IP to the storage account would allow controlling access, confusing storage account public endpoint with a resource that can have a public IP assigned.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Service endpoint
A service endpoint is a specific network address (URL or IP/port) that client applications use to access the functionality or data of a cloud or web service.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.