AZ-104 Implement and Manage Virtual Networking Practice Question
A VM in VNet B can reach a blob storage account through a private endpoint that was created in peered VNet A. The storage FQDN still resolves to the public IP when queried from VNet B, so the VM does not use the private path. What should the administrator change?
⚠ Common exam trap
Many candidates assume VNet peering automatically extends DNS resolution for private endpoints, but in reality, private DNS zones must be explicitly linked to each peered VNet to enable private IP resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Link the private DNS zone used by the private endpoint to VNet B
The private endpoint in VNet A creates a private IP for the storage account, but DNS resolution in VNet B still returns the public IP because the private DNS zone (privatelink.blob.core.windows.net) is not linked to VNet B. By linking the private DNS zone to VNet B, the VM will resolve the storage FQDN to the private IP, ensuring traffic uses the private endpoint path through the VNet peering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a service endpoint for Microsoft.Storage to VNet B
Why it's wrong here
Adding a service endpoint for Microsoft.Storage to VNet B changes routing so traffic uses the Azure backbone to reach the storage account, but DNS resolution is unchanged—the storage name still resolves to the public IP address. Because the private endpoint is never selected, the connection bypasses the private link and exposes the public path. Furthermore, service endpoints and private endpoints are alternative mechanisms; enabling one does not configure DNS the way private endpoints require.
When this WOULD be correct
A service endpoint would be correct if the question asked for a way to ensure that traffic from VNet B to the storage account stays within the Azure backbone without using a private endpoint, and the storage account firewall is configured to allow access from that VNet.
- ✓
Link the private DNS zone used by the private endpoint to VNet B
Why this is correct
Private endpoint connectivity depends on DNS resolution returning the private IP address. In a peered virtual network, the DNS zone for the private endpoint must be linked so clients in VNet B resolve the storage name to the private address instead of the public one. Once that DNS path is corrected, traffic follows the private endpoint.
- ✗
Disable the storage account firewall completely
Why it's wrong here
Disabling the storage account firewall removes network access restrictions, which is a security regression, but it still leaves DNS resolution alone. VMs in VNet B will continue resolving the storage account's FQDN to its public IP, not to the private endpoint's private IP, so traffic goes over the public internet path. Even with the firewall off, the private endpoint is only used if DNS returns the 10.x address from the linked private zone, so this action cannot fix connectivity.
When this WOULD be correct
If a VM in VNet B cannot access a storage account due to the storage account firewall blocking public access, and the goal is to allow access from VNet B without using a private endpoint, disabling the firewall would be correct.
- ✗
Move the storage account into VNet B
Why it's wrong here
Storage accounts are regional Azure services that cannot be deployed inside a virtual network; they must be accessed via their public endpoint or private endpoints. Moving the account (even by redeploying) would not resolve the DNS issue—the new storage account's FQDN still points to its public IP unless a private DNS zone is linked to VNet B. Thus, this is not a valid remediation because the architecture fundamentally requires DNS configuration rather than relocating the resource.
When this WOULD be correct
If the question stated that the storage account must be isolated within VNet B and accessible only from that VNet without using a private endpoint or DNS configuration, moving the storage account into VNet B and enabling the storage firewall to deny public access would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Link the private DNS zone used by the private endpoint to VNet BCorrect answer▾
Why this is correct
Private endpoint connectivity depends on DNS resolution returning the private IP address. In a peered virtual network, the DNS zone for the private endpoint must be linked so clients in VNet B resolve the storage name to the private address instead of the public one. Once that DNS path is corrected, traffic follows the private endpoint.
✗Add a service endpoint for Microsoft.Storage to VNet BWrong answer — click to see why▾
Why this is wrong here
A service endpoint for Microsoft.Storage would route traffic to the public IP of the storage account, not to the private endpoint. The VM in VNet B already needs to resolve the storage FQDN to the private IP, which requires DNS resolution through the private DNS zone linked to VNet B.
★ When this WOULD be the correct answer
A service endpoint would be correct if the question asked for a way to ensure that traffic from VNet B to the storage account stays within the Azure backbone without using a private endpoint, and the storage account firewall is configured to allow access from that VNet.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private connectivity, but service endpoints do not provide a private IP address or DNS resolution to a private IP.
✗Disable the storage account firewall completelyWrong answer — click to see why▾
Why this is wrong here
Disabling the storage account firewall would not change DNS resolution; the VM in VNet B would still resolve the FQDN to the public IP because the private DNS zone is not linked to VNet B.
★ When this WOULD be the correct answer
If a VM in VNet B cannot access a storage account due to the storage account firewall blocking public access, and the goal is to allow access from VNet B without using a private endpoint, disabling the firewall would be correct.
Why candidates choose this
Candidates may think the firewall is blocking traffic, but the issue is DNS resolution, not network access control.
✗Move the storage account into VNet BWrong answer — click to see why▾
Why this is wrong here
Moving the storage account into VNet B does not resolve the DNS resolution issue; the private endpoint's DNS zone must be linked to VNet B for the FQDN to resolve to the private IP.
★ When this WOULD be the correct answer
If the question stated that the storage account must be isolated within VNet B and accessible only from that VNet without using a private endpoint or DNS configuration, moving the storage account into VNet B and enabling the storage firewall to deny public access would be correct.
Why candidates choose this
Candidates may think that moving the storage account into the same VNet as the VM automatically ensures private connectivity, overlooking the DNS resolution requirement for private endpoints.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Private DNS zone
A private DNS zone is a hosted DNS namespace that is only resolvable from within specific virtual networks or private environments, not from the public internet.
Key term
VNet peering
VNet peering is a networking connection that links two virtual networks so they can communicate with each other as if they were a single network.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.