AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account should use a private IP address inside a virtual network, and workloads in that VNet must resolve the storage name to the private address. Which two items are required? Select two.
⚠ Common exam trap
It's easy for candidates to confuse service endpoints with private endpoints, assuming both provide a private IP, when in fact only private endpoints assign a private IP from the VNet, while service endpoints merely route traffic over the Microsoft backbone using the service's public IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private endpoint for the storage account in the virtual network so the service gets a private IP.
A private endpoint assigns a private IP address from the virtual network to the storage account, enabling secure, direct connectivity over the Microsoft backbone without traversing the public internet. This is achieved by creating a network interface in the VNet that receives a private IP from the subnet range, which then routes traffic to the storage service via a private link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a private endpoint for the storage account in the virtual network so the service gets a private IP.
Why this is correct
Creating a private endpoint provisions a network interface in your VNet subnet and assigns it a private IP address that is used for all traffic to the storage account. This places the storage service itself on that private IP, so clients inside the VNet can reach it without ever leaving the Microsoft network. Even if the public endpoint is later disabled, the private endpoint continues to work because it uses a separate network path.
- ✓
Create and link the appropriate private DNS zone so the storage account name resolves to the private IP.
Why this is correct
A private DNS zone such as `privatelink.blob.core.windows.net` must be created, linked to your VNet, and configured with an A record pointing to the private endpoint's IP address. Without this, the storage account's FQDN still resolves to the public IP, forcing clients to traverse the internet and bypass the private link. The DNS zone ensures that name resolution consistently returns the private address for all clients in the linked VNet.
- ✗
Enable a service endpoint on the subnet, because service endpoints create a private IP for the storage service.
Why it's wrong here
Service endpoints do not create a private IP address for storage; they simply add the subnet's network identity to the service and route traffic from that subnet to the service's public IP over the Azure backbone. The service's actual address remains public, and the traffic still uses the public endpoint, only with a more secure source address. Private Link's private endpoint is the correct mechanism to get a true private IP for the storage service.
When this WOULD be correct
In a scenario where you need to restrict access to a storage account from a specific VNet without requiring a private IP, enabling a service endpoint on the subnet and configuring the storage firewall to allow that subnet would be correct.
- ✗
Assign a Reader role on the storage account, because RBAC determines the private address used by clients.
Why it's wrong here
RBAC controls who can perform operations and read data, but it has no influence over the network address assigned to a storage account. The private IP is allocated to the network interface attached to the private endpoint, which is a network-layer construct, not an identity-based one. Assigning Reader role only grants read permissions and does nothing to change DNS resolution or the network path used by clients.
When this WOULD be correct
In a scenario where a user needs to allow a specific client to list storage account keys (e.g., for mounting file shares) without granting full contributor access, assigning the Reader role (or a custom role with 'Microsoft.Storage/storageAccounts/listKeys/action') would be required.
- ✗
Disable the storage account firewall, because private endpoints only work when the public endpoint is open.
Why it's wrong here
This is incorrect because private endpoints do not require the public endpoint to be enabled; in fact, you can and often should disable public network access when you want to rely exclusively on a private endpoint. The storage account firewall only filters traffic arriving at the public endpoint, while private endpoint traffic uses a completely separate data path that is not governed by these firewall rules. Disabling the firewall therefore neither grants the service a private IP nor fixes any connectivity issue.
When this WOULD be correct
In a scenario where you need to allow access from a specific public IP range while blocking all other public traffic, you would configure the storage account firewall to allow that IP range. Disabling the firewall entirely would be incorrect in that case as well; a more accurate scenario is when you need to enable public network access for a specific client, you would add an allow rule, not disable the firewall.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a private endpoint for the storage account in the virtual network so the service gets a private IP.Correct answer▾
Why this is correct
Creating a private endpoint provisions a network interface in your VNet subnet and assigns it a private IP address that is used for all traffic to the storage account. This places the storage service itself on that private IP, so clients inside the VNet can reach it without ever leaving the Microsoft network. Even if the public endpoint is later disabled, the private endpoint continues to work because it uses a separate network path.
✗Enable a service endpoint on the subnet, because service endpoints create a private IP for the storage service.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints do not assign a private IP to the storage account; they provide direct connectivity from the VNet to the service over the Microsoft backbone, but the storage account still uses its public IP address.
★ When this WOULD be the correct answer
In a scenario where you need to restrict access to a storage account from a specific VNet without requiring a private IP, enabling a service endpoint on the subnet and configuring the storage firewall to allow that subnet would be correct.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private IPs, or they may believe that service endpoints are sufficient for private connectivity.
✗Assign a Reader role on the storage account, because RBAC determines the private address used by clients.Wrong answer — click to see why▾
Why this is wrong here
Assigning a Reader role on the storage account controls permissions to read data or configuration, but does not affect network-level private IP assignment or DNS resolution. Private IPs are assigned via Private Endpoints, not RBAC.
★ When this WOULD be the correct answer
In a scenario where a user needs to allow a specific client to list storage account keys (e.g., for mounting file shares) without granting full contributor access, assigning the Reader role (or a custom role with 'Microsoft.Storage/storageAccounts/listKeys/action') would be required.
Why candidates choose this
Candidates may confuse RBAC with network access control, thinking that assigning a role somehow grants private network connectivity, or they may overestimate the role of RBAC in network-level configurations.
✗Disable the storage account firewall, because private endpoints only work when the public endpoint is open.Wrong answer — click to see why▾
Why this is wrong here
Private endpoints do not require the storage account firewall to be disabled; they work independently of the public endpoint. The firewall can remain enabled to block public access while private endpoints provide private connectivity.
★ When this WOULD be the correct answer
In a scenario where you need to allow access from a specific public IP range while blocking all other public traffic, you would configure the storage account firewall to allow that IP range. Disabling the firewall entirely would be incorrect in that case as well; a more accurate scenario is when you need to enable public network access for a specific client, you would add an allow rule, not disable the firewall.
Why candidates choose this
Candidates may mistakenly think that private endpoints require the public endpoint to be open, or they confuse private endpoints with service endpoints, which do not change the IP address and require the firewall to allow access from the VNet.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Private IP address
A private IP address is a non-internet-routable address used within a local network to identify devices and allow them to communicate with each other without direct exposure to the public internet.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.