AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a private endpoint and disable public network access on the storage account.

  Why it's wrong here

  A private endpoint installs a private IP for the storage account inside your virtual network and disables public network access, forcing all traffic through that endpoint. This requires DNS reconfiguration (typically via private DNS zones) to redirect existing hostnames to the private IP, which can break clients that currently use the public endpoint. In contrast, a service endpoint and virtual network rule achieve subnet-restricted access without decommissioning the public endpoint or requiring such DNS changes.

  When this WOULD be correct

  When the requirement is to access the storage account privately from a subnet, without exposing it to the public internet, and DNS changes are acceptable. For example: 'A team wants to ensure that traffic to a storage account never leaves the Microsoft backbone network and they are willing to update DNS settings.'

• ✓

  Enable a service endpoint on the subnet and add a virtual network rule on the storage account.

  Why this is correct

  A service endpoint on the subnet gives the storage account visibility of that subnet's traffic while keeping the storage account's public endpoint. Adding a virtual network rule on the storage account then restricts access to only that specific subnet, so requests from other subnets or the internet are rejected. This approach preserves the existing endpoint and requires no DNS changes, making it the correct, minimal configuration for subnet-only access.

• ✗

  Assign the Storage Blob Data Reader role to the subnet.

  Why it's wrong here

  The Storage Blob Data Reader role is an RBAC role that grants data-plane read permissions to a security principal (user, group, or managed identity), not to a subnet. Subnets are not valid RBAC assignment targets, and even if you could assign it, RBAC only controls authorization after a request reaches the service—it does not filter by source network. Therefore, this option would not prevent other subnets or the internet from accessing the storage account.

  When this WOULD be correct

  When the question asks for granting read access to blob data for all resources in a subnet without changing network connectivity, such as allowing VMs in a subnet to read blobs via the public endpoint while using Azure AD authentication.

• ✗

  Associate a route table with a default route to the storage account private IP.

  Why it's wrong here

  A route table controls how packets are forwarded, but storage accounts do not have a customer-defined private IP on their public endpoint; that endpoint is served by Azure's regional infrastructure. Setting a default route (0.0.0.0/0) to a storage private IP would redirect all internet-bound traffic from the subnet to an unreachable target, potentially breaking connectivity. Route tables also cannot authenticate or authorize requests, so they cannot enforce access control the way a virtual network rule does.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question