AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Link the private DNS zone for blob storage to the virtual network.

  Why this is correct

  Private endpoints require private DNS so clients resolve the storage name to the endpoint's private IP instead of the public address. For Blob Storage, the relevant zone is the privatelink.blob.core.windows.net zone, and it must be linked to the VNet used by the clients. Once linked, Azure can answer DNS queries with the private endpoint address, which makes access work consistently without manual hosts file edits.

• ✗

  Create a route table that sends storage traffic to the private endpoint subnet.

  Why it's wrong here

  A route table controls the next hop for IP traffic, not how a host resolves a DNS name. Since the storage account's FQDN still resolves to the public IP without a private DNS zone, clients would keep sending traffic to the public endpoint, bypassing the private endpoint entirely. Moreover, VNet's implicit routes already reach the private endpoint's subnet, so a custom route is unnecessary.

  When this WOULD be correct

  A route table would be correct if the question asked how to force traffic destined to the storage account's public IP address to go through a network virtual appliance (NVA) or a specific next hop, such as in a hub-and-spoke topology where you want to inspect or filter traffic.

• ✗

  Enable a service endpoint on the subnet that hosts the VMs.

  Why it's wrong here

  A service endpoint does not assign a private IP to the service; it simply optimizes routing to the service's public IP range from the VNet. Enabling it does not change DNS resolution, so the storage account's FQDN continues to resolve to the public endpoint, not to the private endpoint. Service endpoints and private endpoints are complementary but separate features, and only a private DNS zone link will make the name resolve to the private IP.

  When this WOULD be correct

  A question asks how to ensure traffic from a subnet to an Azure Storage account stays within the Azure network and does not traverse the internet, without requiring a private endpoint. Enabling a service endpoint on the subnet would be the correct answer.

• ✗

  Assign a public IP address to the private endpoint subnet.

  Why it's wrong here

  Private endpoints are implemented with a network interface that receives a private IP from the subnet; they never receive a public IP. Assigning a public IP to the subnet itself is not permitted and would not alter the public DNS record that maps the storage account's FQDN. Even if a public IP were present, clients resolving the FQDN would still get the public address, not the private endpoint's IP, so connectivity would remain broken from a name-resolution standpoint.

  When this WOULD be correct

  If the question asked how to allow a private endpoint to communicate with the internet (e.g., for outbound traffic), assigning a public IP to the subnet (via NAT gateway or load balancer) could be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question