AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Service endpoint on the subnet plus public DNS, because the storage account will expose a private IP automatically.

  Why it's wrong here

  A service endpoint on the subnet extends the subnet's network identity to the storage service and routes traffic over the Azure backbone, but the storage account continues to be reachable only via its public endpoint. The service does not acquire a private IP address in your VNet; enabling the endpoint merely adds an effective route for the service's public IP range from the subnet. Public DNS still resolves the storage account name to the public IP, so the premise that a private IP appears automatically is incorrect.

  When this WOULD be correct

  A question requiring secure access from a VM to a storage account without disabling the public endpoint, where the goal is to avoid internet routing and reduce costs, and private IP is not required. Service endpoints on the subnet would be correct.

• ✓

  Private endpoint with a private DNS zone linked to the virtual network.

  Why this is correct

  A private endpoint places the storage service behind a private IP address in your virtual network, which is exactly what the scenario requires. Linking a private DNS zone ensures the storage account name resolves to that private IP from resources inside the VNet. Together, these settings provide private network access and allow you to disable the public endpoint safely.

• ✗

  Network security group rules only, because they can force traffic to use private addressing.

  Why it's wrong here

  Network security group rules are stateful packet filters applied at the subnet or network interface level; they can permit or deny traffic but cannot provision a private endpoint or modify DNS name resolution. Even if you create an NSG rule that allows all outbound traffic, the storage account still resolves to its public endpoint IP. NSGs have no mechanism to redirect or translate that destination to a private address, so they cannot alone make storage accessible via a private IP.

  When this WOULD be correct

  A question asks: 'You need to restrict inbound traffic to a subnet to only allow traffic from a specific IP range. Which configuration should you use?' In that scenario, NSG rules are the correct answer.

• ✗

  Storage account firewall rules with Allow trusted Microsoft services, because that gives a private address path.

  Why it's wrong here

  Storage account firewall rules, even with 'Allow trusted Microsoft services' enabled, operate as access-control filters on the public endpoint. They do not assign a private IP address to the storage account in the VM's virtual network, nor do they alter DNS resolution so the account name maps to a private address. The VM would still traverse the public endpoint (or Microsoft's backbone via the trusted-service exception) using the storage account's public IP, not a private IP inside the VNet.

  When this WOULD be correct

  This option would be correct in a scenario where the requirement is to restrict access to a storage account to only trusted Microsoft services (e.g., Azure Backup) while keeping the public endpoint enabled, and no private IP connectivity is needed.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question