AZ-104 Implement and Manage Virtual Networking Practice Question
A VM in VNet A can reach a storage account through a private endpoint, but when the VM resolves the storage account name it still gets the public IP address. What should you configure so name resolution returns the private endpoint address?
⚠ Common exam trap
Many exam-takers confuse network-level routing (UDRs) with DNS resolution, assuming that directing traffic to the private endpoint IP via a route will fix name resolution, when in fact DNS must be explicitly configured to return the private IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The private DNS zone linked to the VNet
When a private endpoint is created for a storage account, the DNS configuration must be updated so that the storage account's fully qualified domain name resolves to the private endpoint's private IP address instead of the public IP. Linking a private DNS zone (privatelink.blob.core.windows.net) to the virtual network and configuring a virtual network link ensures that the VM's DNS queries for the storage account are answered with the private endpoint IP. Without this, the VM continues to use the public IP from public DNS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A user-defined route to the storage private endpoint
Why it's wrong here
A user-defined route (UDR) to the storage private endpoint controls the path that network traffic takes, such as forcing it through a firewall or to a virtual appliance, but it does not influence the DNS answer that a VM receives. The private endpoint already installs a system route in the subnet directing traffic destined for its private IP to the endpoint's network interface, so a custom UDR is unnecessary for basic connectivity. More critically, the VM first needs to resolve the storage account name to the private IP via a private DNS zone; without that, the UDR is irrelevant because the traffic would still go to the public IP.
When this WOULD be correct
A UDR would be correct if the question were about forcing traffic from a VM to a storage account through a firewall or network virtual appliance (NVA) instead of directly over the internet or Microsoft backbone.
- ✓
The private DNS zone linked to the VNet
Why this is correct
A private DNS zone linked to the VNet is required because the storage account's FQDN (e.g., mystorageaccount.blob.core.windows.net) must resolve to the private endpoint's private IP address within the VNet. When you create a private endpoint, Azure automatically associates it with a private DNS zone only if you explicitly configure it; otherwise, the FQDN still resolves to the public IP. Linking the private DNS zone and ensuring the VNet uses Azure's built-in resolver (or a custom forwarder) allows the VM to reach the storage account over the private endpoint, keeping traffic off the public internet.
- ✗
A resource lock on the storage account
Why it's wrong here
A resource lock on the storage account is an Azure governance control that prevents accidental deletion or modification of the resource by enforcing a read-only or delete restriction. However, it has no influence on DNS name resolution or network connectivity—it cannot create DNS records, alter private endpoint mapping, or change how a VM resolves the storage FQDN. Even with a lock, the VM would still resolve to the public IP if a private DNS zone is missing, so connectivity remains broken.
When this WOULD be correct
A resource lock would be correct in a scenario where you need to protect a critical storage account from accidental deletion or changes, such as in a production environment where an administrator might inadvertently delete the resource.
- ✗
A managed identity for the VM
Why it's wrong here
A managed identity for the VM provides an Azure Active Directory identity that can be used to authenticate to services like Blob Storage, obtaining tokens for authorization. It operates at the application/control-plane level and has no bearing on the data-plane DNS lookup that translates the storage account name into an IP address. Without the private DNS zone, the VM's DNS query returns the public IP regardless of whether the VM has a managed identity enabled, so this option does not address name resolution.
When this WOULD be correct
A managed identity would be correct if the question asked how to allow a VM to authenticate to a storage account without using storage account keys or connection strings, for example: 'You need to enable a VM to securely access a storage account without storing credentials in the VM. What should you configure?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓The private DNS zone linked to the VNetCorrect answer▾
Why this is correct
A private DNS zone linked to the VNet is required because the storage account's FQDN (e.g., mystorageaccount.blob.core.windows.net) must resolve to the private endpoint's private IP address within the VNet. When you create a private endpoint, Azure automatically associates it with a private DNS zone only if you explicitly configure it; otherwise, the FQDN still resolves to the public IP. Linking the private DNS zone and ensuring the VNet uses Azure's built-in resolver (or a custom forwarder) allows the VM to reach the storage account over the private endpoint, keeping traffic off the public internet.
✗A user-defined route to the storage private endpointWrong answer — click to see why▾
Why this is wrong here
A user-defined route (UDR) controls network traffic flow, not DNS resolution. The VM still gets the public IP because DNS is not configured to resolve the storage account name to the private endpoint's private IP address.
★ When this WOULD be the correct answer
A UDR would be correct if the question were about forcing traffic from a VM to a storage account through a firewall or network virtual appliance (NVA) instead of directly over the internet or Microsoft backbone.
Why candidates choose this
Candidates may confuse routing with DNS resolution, thinking that a UDR can redirect traffic to the private endpoint's IP, but DNS must first resolve to that IP for the route to apply.
✗A resource lock on the storage accountWrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of the storage account, but it does not affect DNS resolution or private endpoint connectivity. The issue is name resolution, not resource protection.
★ When this WOULD be the correct answer
A resource lock would be correct in a scenario where you need to protect a critical storage account from accidental deletion or changes, such as in a production environment where an administrator might inadvertently delete the resource.
Why candidates choose this
Candidates may confuse resource locks with access controls or think that locking the storage account somehow enforces private endpoint usage, not realizing that DNS resolution is a separate concern.
✗A managed identity for the VMWrong answer — click to see why▾
Why this is wrong here
A managed identity provides Azure AD authentication for the VM to access the storage account, but it does not affect DNS name resolution or routing. The VM still uses public DNS resolution for the storage account name, so it gets the public IP address.
★ When this WOULD be the correct answer
A managed identity would be correct if the question asked how to allow a VM to authenticate to a storage account without using storage account keys or connection strings, for example: 'You need to enable a VM to securely access a storage account without storing credentials in the VM. What should you configure?'
Why candidates choose this
Candidates may confuse authentication with network connectivity, thinking that a managed identity somehow changes how the VM resolves the storage account name or routes traffic to the private endpoint.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
Key term
Private IP address
A private IP address is a non-internet-routable address used within a local network to identify devices and allow them to communicate with each other without direct exposure to the public internet.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.