AZ-104 Implement and Manage Storage Practice Question
A team wants an Azure Storage account to be reachable only from a single Azure virtual network and to use a private IP address inside that network. Which option should the administrator configure?
⚠ Common exam trap
Test-takers frequently confuse service endpoints with private endpoints: both restrict access to a VNet, but only a private endpoint provides a private IP address and fully removes public internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint for the storage account.
A private endpoint assigns a private IP address from the virtual network to the storage account, making it reachable only from that VNet over the Microsoft backbone network. This meets the requirement of exclusive access and private IP usage, unlike a service endpoint which still exposes the storage account to the public internet via its public endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service endpoint on the subnet.
Why it's wrong here
A service endpoint does not give Storage a private IP; it simply marks your subnet as a trusted source, so the storage account's public endpoint can be firewalled to accept traffic only from that subnet. The storage account still has a publicly resolvable DNS name and can be reached from any other IP unless you also configure strict network rules. Therefore, it reduces exposure but does not make the storage account reachable only from your VNet—it still uses the shared public endpoint.
When this WOULD be correct
When the requirement is to restrict access to the storage account from a specific subnet without needing a private IP, and the storage account can remain accessible over the public internet from that subnet.
- ✓
A private endpoint for the storage account.
Why this is correct
Unlike other options, a private endpoint (via Azure Private Link) places the storage account on the VNet by assigning it a private IP address from your subnet's address space. This removes the public endpoint from reachability, and when combined with a private DNS zone, traffic resolves only to that private IP. Because all access must traverse the VNet or peered networks, it is the only option that truly restricts access to a private-only path.
- ✗
A public IP address with an NSG inbound allow rule.
Why it's wrong here
An NSG is applied to a subnet or a virtual NIC, not to a PaaS service like Azure Storage, and storage accounts do not expose a selectable public IP that an NSG can protect. Adding an inbound allow rule on an NSG would, at best, affect only the resource that owns that NIC—not the storage service. Moreover, any public-IP approach still leaves the storage account reachable via its public DNS name from permitted sources, so it does not restrict access to private network paths only.
When this WOULD be correct
This option would be correct if the question asked for a storage account accessible from the internet but only from specific public IP ranges, requiring an NSG to filter inbound traffic.
- ✗
A VPN gateway connection to the storage account.
Why it's wrong here
A VPN gateway connects your on-premises network or VNet to Azure at the network layer, but it does not create a private address for the storage account itself. To route storage traffic over the VPN tunnel, you still need a private endpoint or a service endpoint to pull the storage service into the VNet address space. Without one, the VPN gateway alone cannot make Storage a private-only resource; it simply provides encrypted connectivity between networks.
When this WOULD be correct
An administrator needs to connect an on-premises network to an Azure Storage account securely over the internet or ExpressRoute, ensuring traffic traverses encrypted tunnels and the storage account is accessible only from the on-premises network.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpoint for the storage account.Correct answer▾
Why this is correct
Unlike other options, a private endpoint (via Azure Private Link) places the storage account on the VNet by assigning it a private IP address from your subnet's address space. This removes the public endpoint from reachability, and when combined with a private DNS zone, traffic resolves only to that private IP. Because all access must traverse the VNet or peered networks, it is the only option that truly restricts access to a private-only path.
✗A service endpoint on the subnet.Wrong answer — click to see why▾
Why this is wrong here
A service endpoint allows access from a specific subnet but does not provide a private IP address for the storage account; the storage account still uses its public endpoint, only restricted to the subnet's traffic.
★ When this WOULD be the correct answer
When the requirement is to restrict access to the storage account from a specific subnet without needing a private IP, and the storage account can remain accessible over the public internet from that subnet.
Why candidates choose this
Candidates confuse service endpoints with private endpoints, thinking both provide private connectivity, but service endpoints only secure the public endpoint to a subnet.
✗A public IP address with an NSG inbound allow rule.Wrong answer — click to see why▾
Why this is wrong here
A public IP address with an NSG rule allows inbound traffic from the internet, which contradicts the requirement to restrict access to a single virtual network and use a private IP address.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a storage account accessible from the internet but only from specific public IP ranges, requiring an NSG to filter inbound traffic.
Why candidates choose this
Candidates may think that an NSG rule can restrict access to the storage account, but they overlook that the storage account itself must be publicly exposed for NSGs to apply, which does not meet the private IP requirement.
✗A VPN gateway connection to the storage account.Wrong answer — click to see why▾
Why this is wrong here
A VPN gateway connection is used for site-to-site or point-to-site connectivity from on-premises networks, not for restricting access to a single Azure virtual network with a private IP address.
★ When this WOULD be the correct answer
An administrator needs to connect an on-premises network to an Azure Storage account securely over the internet or ExpressRoute, ensuring traffic traverses encrypted tunnels and the storage account is accessible only from the on-premises network.
Why candidates choose this
Candidates may confuse VPN gateway with private endpoint, thinking that a VPN provides private connectivity, but it does not assign a private IP address within the virtual network or restrict access to a single VNet.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.