AZ-104 Implement and Manage Virtual Networking Practice Question
A team wants an Azure VM in a subnet to reach a storage account securely without opening the account to the entire internet. Which two configuration choices can be used to achieve this? Select two.
⚠ Common exam trap
Candidates often confuse service endpoints with private endpoints, thinking both are interchangeable, but service endpoints still use the storage account's public endpoint (just restricted by subnet), while private endpoints use a private IP from the subnet, making private endpoints the more secure choice for scenarios requiring complete isolation from the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Private endpoint
Private endpoint (A) assigns a private IP address from the VM's subnet to the storage account, enabling secure connectivity over the Microsoft backbone network without exposing the account to the public internet. Service endpoint (B) extends the virtual network identity to the storage account via its public endpoint but restricts access to traffic originating from the specified subnet, also avoiding full internet exposure. Both options satisfy the requirement for secure, subnet-restricted access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Private endpoint
Why this is correct
A private endpoint assigns the storage account a network interface with a private IP from the virtual network's subnet, so traffic from the VM flows directly to that IP over the Microsoft backbone without leaving the VNet. You must also configure DNS to resolve the storage account's FQDN to that private IP. This removes exposure to the public internet and is the recommended way to establish secure, subnet-scoped connectivity.
- ✓
Service endpoint
Why this is correct
A service endpoint extends the virtual network's identity to the storage account by allowing traffic from the subnet to the storage account's public IP address, but only when the source address in the packet remains the subnet's private IP. It uses a service endpoint route to ensure that traffic to Azure Storage bypasses the internet and stays on the Azure backbone. However, the storage account still has a public endpoint, so the connection is primarily restricted by enabling the service endpoint on the specific subnet and adding a network rule.
- ✗
Enable anonymous blob access
Why it's wrong here
Enabling anonymous blob access removes the need for an authorization token on the blob, but it does not affect network-level access control. The storage account's public endpoint remains reachable by any client from anywhere unless a separate network rule blocks it. Anonymous access is an authentication and authorization change, not a network security boundary, and actually expands attack surface rather than restricting connectivity to a specific VM or subnet.
When this WOULD be correct
In a scenario where the requirement is to allow public read access to blob data without authentication (e.g., for hosting static websites or sharing public content), enabling anonymous blob access would be correct.
- ✗
Move the account to the Archive tier
Why it's wrong here
The Archive access tier is designed to store data that is rarely accessed, offering low storage cost but high retrieval latency and extra retrieval charges. Switching a storage account to Archive tier only changes the underlying blob tier and requires rehydration before reading, but it does not alter any network permissions or network routing. The account's network endpoints and access rules remain unchanged, so moving the account to the Archive tier does not grant a VM access.
When this WOULD be correct
A question asks which Azure storage tier is most cost-effective for long-term backup data that is rarely accessed and has a high tolerance for retrieval latency, with a minimum retention period of 180 days.
- ✗
Apply a delete lock to the storage account
Why it's wrong here
A delete lock, when applied to the storage account or its resource group, prevents accidental deletion of the resource but has no impact on data plane operations like reading or writing blobs. It does not modify the storage account's firewall rules, service endpoints, or private endpoint configuration. Consequently, it cannot enable or deny a virtual machine in a subnet from reaching the storage account's endpoint.
When this WOULD be correct
A question asks: 'You need to prevent accidental deletion of a storage account while allowing authorized users to modify its configuration. Which solution should you use?' In that scenario, a delete lock is correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Private endpointCorrect answer▾
Why this is correct
A private endpoint assigns the storage account a network interface with a private IP from the virtual network's subnet, so traffic from the VM flows directly to that IP over the Microsoft backbone without leaving the VNet. You must also configure DNS to resolve the storage account's FQDN to that private IP. This removes exposure to the public internet and is the recommended way to establish secure, subnet-scoped connectivity.
✗Enable anonymous blob accessWrong answer — click to see why▾
Why this is wrong here
Enabling anonymous blob access would allow any internet user to access the storage account without authentication, which violates the requirement to keep the storage account secure and not open to the entire internet.
★ When this WOULD be the correct answer
In a scenario where the requirement is to allow public read access to blob data without authentication (e.g., for hosting static websites or sharing public content), enabling anonymous blob access would be correct.
Why candidates choose this
Candidates might think that enabling anonymous access is a way to allow access without opening the entire account, but they overlook that it actually opens the account to the entire internet, which is the opposite of the security requirement.
✗Move the account to the Archive tierWrong answer — click to see why▾
Why this is wrong here
Moving a storage account to the Archive tier does not affect network security; it only changes the access tier for cost optimization, leaving the account still accessible over the internet if not otherwise restricted.
★ When this WOULD be the correct answer
A question asks which Azure storage tier is most cost-effective for long-term backup data that is rarely accessed and has a high tolerance for retrieval latency, with a minimum retention period of 180 days.
Why candidates choose this
Candidates may confuse 'Archive' with 'isolated' or 'secure', thinking that archiving data somehow hides it from the internet, when in fact it only affects storage cost and retrieval time.
✗Apply a delete lock to the storage accountWrong answer — click to see why▾
Why this is wrong here
Applying a delete lock prevents accidental deletion of the storage account but does not provide secure network access from a VM to the storage account. It does not restrict traffic to a specific subnet or private IP.
★ When this WOULD be the correct answer
A question asks: 'You need to prevent accidental deletion of a storage account while allowing authorized users to modify its configuration. Which solution should you use?' In that scenario, a delete lock is correct.
Why candidates choose this
Candidates may confuse 'lock' with 'secure access' or think that locking the account somehow restricts network access, not realizing locks only affect management operations, not data plane access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
Key term
Private IP address
A private IP address is a non-internet-routable address used within a local network to identify devices and allow them to communicate with each other without direct exposure to the public internet.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.