AZ-104 Implement and Manage Virtual Networking Practice Question
A VM in a subnet must access an Azure Storage account without creating a private endpoint. The organization is fine with the storage account remaining on its public endpoint, but traffic should stay on the Azure backbone rather than the public internet. Which feature should you use?
⚠ Common exam trap
Many exam-takers confuse service endpoints with private endpoints, assuming both require private IPs, but service endpoints keep the public endpoint while routing traffic over the Azure backbone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service endpoint for Microsoft.Storage on the subnet.
A service endpoint for Microsoft.Storage on the subnet extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to traverse the Azure backbone network instead of the public internet. This meets the requirement of keeping traffic on the Azure backbone without creating a private endpoint, as service endpoints use the public endpoint but route traffic through Microsoft's network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A service endpoint for Microsoft.Storage on the subnet.
Why this is correct
A service endpoint extends the VNet identity to the supported Azure service and keeps traffic on the Microsoft backbone. It does not create a private IP or require DNS changes, which matches this requirement. The storage account can remain on its public endpoint while still accepting traffic only from the allowed subnet.
- ✗
A private endpoint and a private DNS zone.
Why it's wrong here
A private endpoint assigns the storage account a private IP address from the VNet, which requires a private DNS zone to resolve the storage account's FQDN to that private IP. The question explicitly states that a private endpoint must not be created, so this option violates a core constraint. Even if DNS changes are acceptable in other scenarios, this solution adds complexity (private endpoint, DNS zone, and often a private link) when a simpler service endpoint meets the requirement without private IP usage.
When this WOULD be correct
This option would be correct in a scenario where the organization requires the storage account to be accessible only from a specific virtual network and not over the public internet at all, and they are willing to create a private endpoint. For example: 'A VM in a subnet must access an Azure Storage account with traffic staying entirely on the Microsoft backbone and the storage account must not be accessible from the public internet. Which feature should you use?'
- ✗
A NAT gateway attached to the subnet.
Why it's wrong here
A NAT gateway is used for outbound internet connectivity from a subnet, providing source network address translation to a single public IP or IP prefix. It does not establish a connection to a specific Azure service, nor does it keep traffic on the Microsoft backbone; it simply translates the source IP for traffic that is already routed outbound. Furthermore, NAT gateways do not restrict or authorize access to a storage account—they only affect the source IP that Azure services see, which is not sufficient for service-level access control.
When this WOULD be correct
When a question requires outbound internet access from a subnet with a static public IP and no other outbound connectivity, and the goal is to avoid SNAT port exhaustion or enable connection to external services that require a fixed public IP.
- ✗
A VPN gateway connection to the storage account resource group.
Why it's wrong here
A VPN gateway connection is designed for site-to-site or point-to-site IPsec tunnels between on-premises networks and an Azure VNet, or between VNets. It does not create a service-specific data path to a PaaS resource like Storage; the storage account's public endpoint would still be used unless a service endpoint or private endpoint is configured. Moreover, attaching the gateway to the storage account's resource group is irrelevant because resource group boundaries do not affect network connectivity, and VPN gateways only connect to the VNet where they are deployed, not to a storage account.
When this WOULD be correct
This option would be correct if the question required connecting an on-premises network to an Azure storage account securely over the internet, using a site-to-site VPN, and the storage account was configured to accept traffic only from the VPN gateway's public IP.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A service endpoint for Microsoft.Storage on the subnet.Correct answer▾
Why this is correct
A service endpoint extends the VNet identity to the supported Azure service and keeps traffic on the Microsoft backbone. It does not create a private IP or require DNS changes, which matches this requirement. The storage account can remain on its public endpoint while still accepting traffic only from the allowed subnet.
✗A private endpoint and a private DNS zone.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly states 'without creating a private endpoint,' so using a private endpoint (option B) violates that constraint. Additionally, the storage account remains on its public endpoint, which is incompatible with private endpoint usage.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the organization requires the storage account to be accessible only from a specific virtual network and not over the public internet at all, and they are willing to create a private endpoint. For example: 'A VM in a subnet must access an Azure Storage account with traffic staying entirely on the Microsoft backbone and the storage account must not be accessible from the public internet. Which feature should you use?'
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide similar private connectivity. They might also believe that a private endpoint is the only way to keep traffic on the Azure backbone, overlooking that service endpoints also route traffic over the Microsoft network.
✗A NAT gateway attached to the subnet.Wrong answer — click to see why▾
Why this is wrong here
A NAT gateway provides outbound internet connectivity with source network address translation, but it does not ensure traffic to Azure Storage stays on the Azure backbone; traffic still traverses the public internet.
★ When this WOULD be the correct answer
When a question requires outbound internet access from a subnet with a static public IP and no other outbound connectivity, and the goal is to avoid SNAT port exhaustion or enable connection to external services that require a fixed public IP.
Why candidates choose this
Candidates may confuse NAT gateway with service endpoints, thinking it provides a secure, private path to Azure services, but NAT gateway only translates IP addresses and does not route traffic over the Azure backbone.
✗A VPN gateway connection to the storage account resource group.Wrong answer — click to see why▾
Why this is wrong here
A VPN gateway connection to the storage account resource group does not provide a direct path from the subnet to the storage account over the Azure backbone; it would require routing traffic through a VPN gateway, which is unnecessary and does not keep traffic on the Microsoft backbone for public endpoint access.
★ When this WOULD be the correct answer
This option would be correct if the question required connecting an on-premises network to an Azure storage account securely over the internet, using a site-to-site VPN, and the storage account was configured to accept traffic only from the VPN gateway's public IP.
Why candidates choose this
Candidates may think a VPN gateway ensures private connectivity, but it is designed for hybrid connectivity, not for keeping Azure-to-Azure traffic on the backbone without a private endpoint.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
Service endpoint
A service endpoint is a specific network address (URL or IP/port) that client applications use to access the functionality or data of a cloud or web service.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.