AZ-104 Implement and Manage Storage Practice Question
A storage account should accept requests only from a specific virtual network subnet in Azure. The team does not want traffic to reach the public endpoint from the internet. What should the administrator configure?
⚠ Common exam trap
Watch out — candidates often confuse network-level access controls (like service endpoints or private endpoints) with RBAC roles or storage tier changes, mistakenly thinking that assigning a role or changing a tier can restrict network traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a storage network rule for the subnet or use a private endpoint
Azure storage accounts can restrict access to specific virtual network subnets using service endpoints or private endpoints. A storage network rule for the subnet allows traffic only from that subnet, while a private endpoint maps the storage account to a private IP in the VNet, completely bypassing the public endpoint. This ensures no internet traffic reaches the public endpoint, meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable anonymous blob access
Why it's wrong here
Enabling anonymous blob access configures the container's public access level so clients can read blobs without providing an authorization token, but this actually increases exposure by allowing any internet user with the link to connect. Anonymous access is an authorization setting, not a network filter, so it does nothing to limit requests by source subnet or IP address. Instead of restricting traffic, it removes the authentication requirement, making the data publicly reachable, which is the opposite of the desired outcome.
When this WOULD be correct
When the requirement is to allow unauthenticated read access to blob containers (e.g., for hosting static websites or sharing public data) without needing shared access signatures or Azure AD authentication.
- ✓
Add a storage network rule for the subnet or use a private endpoint
Why this is correct
This is the correct approach because Azure Storage network rules allow you to permit traffic only from a specific virtual network subnet or IP range, effectively blocking requests from any other network source. Alternatively, a private endpoint assigns the storage account a private IP address from your virtual network, ensuring all client traffic traverses a private, Microsoft-managed path rather than the public internet. Both options enforce a network-level boundary, which is exactly what is needed to restrict requests to a specific subnet while keeping all other sources denied.
- ✗
Move the container to the Archive tier
Why it's wrong here
Moving a container to the Archive tier changes the blob's access tier to optimize for infrequent data storage and cost, but it has no effect on which networks or IP addresses can reach the storage account. The Archive tier even requires rehydration before data can be read, and it does not alter any network rules, firewalls, or access controls. Therefore, it cannot restrict incoming requests to a specific subnet; it only affects data lifecycle and latency, not network connectivity.
- ✗
Assign the Contributor role to the subnet
Why it's wrong here
Assigning the Contributor role to a subnet is invalid because Azure RBAC roles are granted to security principals such as users, groups, service principals, or managed identities, not to network subnets. Even if you could assign a role to a subnet, Contributor grants management-level permissions to create or modify resources, not the ability to filter or route inbound network traffic. Therefore, this action does not restrict which networks can access the storage account; it would only potentially allow a principal to manage resources, unrelated to network path control.
When this WOULD be correct
An administrator needs to allow a specific subnet's virtual machines to manage storage account resources (e.g., create containers) while preventing other users from doing so. Assigning the Contributor role to the subnet's managed identity would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add a storage network rule for the subnet or use a private endpointCorrect answer▾
Why this is correct
This is the correct approach because Azure Storage network rules allow you to permit traffic only from a specific virtual network subnet or IP range, effectively blocking requests from any other network source. Alternatively, a private endpoint assigns the storage account a private IP address from your virtual network, ensuring all client traffic traverses a private, Microsoft-managed path rather than the public internet. Both options enforce a network-level boundary, which is exactly what is needed to restrict requests to a specific subnet while keeping all other sources denied.
✗Enable anonymous blob accessWrong answer — click to see why▾
Why this is wrong here
Enabling anonymous blob access allows public read access to blob data without authentication, but does not restrict network traffic to a specific subnet or block internet access to the public endpoint.
★ When this WOULD be the correct answer
When the requirement is to allow unauthenticated read access to blob containers (e.g., for hosting static websites or sharing public data) without needing shared access signatures or Azure AD authentication.
Why candidates choose this
Candidates may confuse 'anonymous access' with 'network restriction' because both involve controlling access, but anonymous access controls authentication, not network-level traffic filtering.
✗Assign the Contributor role to the subnetWrong answer — click to see why▾
Why this is wrong here
Assigning the Contributor role to a subnet grants management permissions but does not restrict network access to the storage account's public endpoint; it does not block internet traffic.
★ When this WOULD be the correct answer
An administrator needs to allow a specific subnet's virtual machines to manage storage account resources (e.g., create containers) while preventing other users from doing so. Assigning the Contributor role to the subnet's managed identity would be correct.
Why candidates choose this
Candidates may confuse role-based access control (RBAC) with network security controls, thinking that assigning a role can restrict access to only that subnet.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.