AZ-104 Implement and Manage Virtual Networking Practice Question
A team deployed a private endpoint for an Azure Storage account in VNet-A. The private endpoint is healthy, but VMs in VNet-A still resolve the storage account name to the public IP address. What should the administrator configure next?
⚠ Common exam trap
Candidates often confuse network-level controls (route tables, NSGs, service endpoints) with DNS resolution, assuming that a healthy private endpoint alone will automatically change how the storage account name is resolved.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Link the appropriate private DNS zone to VNet-A.
When a private endpoint is deployed, the storage account's FQDN must resolve to the private IP address within the virtual network. By default, Azure Private DNS zones (privatelink.blob.core.windows.net) are not automatically linked to the virtual network. Linking the private DNS zone to VNet-A enables DNS resolution of the storage account name to the private endpoint's IP address instead of the public IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a route table that sends storage traffic to the private endpoint.
Why it's wrong here
A route table directing storage traffic to the private endpoint would only apply after the destination IP address is determined. Since the FQDN still resolves to the public IP, the traffic would never be routed toward the private endpoint; the route would be bypassed entirely. Also, private endpoints automatically inject a system route for their /32 private IP, so a custom route is neither necessary nor effective for fixing the DNS resolution problem at the root.
When this WOULD be correct
This option would be correct if the question described a scenario where VMs in VNet-A need to access a storage account via a service endpoint (not private endpoint) and the default route (0.0.0.0/0) is sending traffic to the internet. A route table with a more specific route to the storage account's public IP via the service endpoint would force traffic through the Azure backbone.
- ✓
Link the appropriate private DNS zone to VNet-A.
Why this is correct
Private endpoints depend on DNS so client requests resolve the service name to the private IP rather than the public endpoint. If VMs in VNet-A still receive the public address, the private DNS zone is not linked or not configured correctly for that VNet. Linking the zone ensures the Azure-provided or custom DNS path returns the private endpoint address, allowing the workloads to reach the storage account privately as intended.
- ✗
Create a network security group rule that allows outbound HTTPS.
Why it's wrong here
Creating an NSG rule that allows outbound HTTPS addresses only reachability restrictions, not name resolution. The VM's DNS query for the storage FQDN will still return the public endpoint because no private DNS zone is linked to VNet-A. Even if the rule is added, traffic would continue to the public IP, leaving the private endpoint unused. NSG rules operate at the network layer and cannot influence or override DNS responses.
When this WOULD be correct
An administrator needs to allow VMs in a subnet to access a storage account over the internet (public endpoint) while blocking other outbound HTTPS traffic. An NSG rule allowing outbound HTTPS to the storage account's public IP would be correct.
- ✗
Enable service endpoints for Microsoft.Storage on the subnet.
Why it's wrong here
Service endpoints for Microsoft.Storage let subnets reach the storage service over the Microsoft backbone while still using the public endpoint IP. They do not assign a private IP address to the storage account and have no effect on DNS resolution. Enabling service endpoints would not cause the FQDN to resolve to the private endpoint address, so VMs would continue to see the public A record. The missing private DNS zone link remains the essential fix.
When this WOULD be correct
In a scenario where the goal is to secure access to the storage account from VMs in a VNet without using a private endpoint, and the storage account's firewall is configured to allow access only from that VNet's service endpoint.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Link the appropriate private DNS zone to VNet-A.Correct answer▾
Why this is correct
Private endpoints depend on DNS so client requests resolve the service name to the private IP rather than the public endpoint. If VMs in VNet-A still receive the public address, the private DNS zone is not linked or not configured correctly for that VNet. Linking the zone ensures the Azure-provided or custom DNS path returns the private endpoint address, allowing the workloads to reach the storage account privately as intended.
✗Add a route table that sends storage traffic to the private endpoint.Wrong answer — click to see why▾
Why this is wrong here
A route table cannot redirect traffic to a private endpoint because private endpoints use Azure Private Link, which relies on DNS resolution to direct traffic to the private IP, not routing. Route tables affect network traffic based on IP prefixes, but the private endpoint's IP is not a destination prefix that can be routed to; the traffic must first resolve to the private IP via DNS.
★ When this WOULD be the correct answer
This option would be correct if the question described a scenario where VMs in VNet-A need to access a storage account via a service endpoint (not private endpoint) and the default route (0.0.0.0/0) is sending traffic to the internet. A route table with a more specific route to the storage account's public IP via the service endpoint would force traffic through the Azure backbone.
Why candidates choose this
Candidates may think that since a private endpoint is a network interface, they can add a route to direct traffic to it, similar to how they would add a route to a virtual appliance or NAT device. They overlook that private endpoints rely on DNS resolution, not routing tables, to steer traffic.
✗Create a network security group rule that allows outbound HTTPS.Wrong answer — click to see why▾
Why this is wrong here
The issue is DNS resolution, not network traffic filtering. NSG rules control inbound/outbound traffic but do not affect how VMs resolve the storage account's FQDN to an IP address.
★ When this WOULD be the correct answer
An administrator needs to allow VMs in a subnet to access a storage account over the internet (public endpoint) while blocking other outbound HTTPS traffic. An NSG rule allowing outbound HTTPS to the storage account's public IP would be correct.
Why candidates choose this
Candidates may think that since private endpoints use private IPs, an NSG rule is needed to allow traffic to the private endpoint, or they confuse network security with DNS resolution.
✗Enable service endpoints for Microsoft.Storage on the subnet.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints route traffic to the public IP of the storage account via the Azure backbone, not to a private endpoint. They do not enable private DNS resolution, so VMs would still resolve the storage account to its public IP.
★ When this WOULD be the correct answer
In a scenario where the goal is to secure access to the storage account from VMs in a VNet without using a private endpoint, and the storage account's firewall is configured to allow access only from that VNet's service endpoint.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private IP resolution, or they may believe service endpoints are required to route traffic to a private endpoint.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.