AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

  Why it's wrong here

  A service endpoint to Microsoft.Storage adds a route from the subnet to the storage service's public IP address, allowing traffic to pass over the Microsoft backbone instead of the public internet, but the storage account still resolves to its public endpoint. The storage account is not given a private IP address in the subnet, and leaving the public endpoint enabled means the account remains accessible from outside the subnet. This configuration fails the private-IP and subnet-scoped connectivity requirements, so it is not a substitute for a private endpoint.

  When this WOULD be correct

  This option would be correct if the requirement was to allow a subnet to access a storage account securely over the Microsoft backbone network while still keeping the public endpoint enabled for other clients, and there was no need for a private IP or disabling public access.

• ✓

  Create a private endpoint in the subnet and disable public network access on the storage account.

  Why this is correct

  A private endpoint places a private IP address for the storage account into the VNet, so traffic stays on the private network path. Disabling public network access ensures the account cannot be reached through its public endpoint. Together, these settings meet both requirements: private IP access and subnet-scoped connectivity.

• ✗

  Use a shared access signature token and leave network settings unchanged.

  Why it's wrong here

  A shared access signature (SAS) token provides fine-grained, time-limited authorization to specific storage operations, such as reading a blob or uploading a file. However, a SAS controls what a caller is allowed to do, not which network path the traffic takes—the request still goes to the storage account's public endpoint. Additionally, leaving network settings unchanged keeps the public endpoint open to any IP, so the SAS does nothing to restrict access to the subnet or force traffic onto a private IP address.

  When this WOULD be correct

  If the question required granting time-limited, delegated access to a specific storage resource (e.g., a blob or file) for an external user or application without changing network security settings, a SAS token would be the correct answer.

• ✗

  Associate the storage account with a NAT gateway to control inbound access.

  Why it's wrong here

  A NAT gateway is designed to manage outbound source IP addresses for subnets; it does not accept inbound connections or alter how Azure Storage receives requests from an application. Since the application initiates the connection to the storage account, a NAT gateway has no effect on the inbound network path, and it never assigns a private IP address to the storage account. Therefore, it cannot satisfy the requirement to keep the storage account reachable only via a private IP within the subnet.

  When this WOULD be correct

  An administrator needs to provide outbound internet connectivity for resources in a subnet while using a static public IP for egress, and the storage account is accessed via its public endpoint with firewall rules. In that scenario, a NAT gateway would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question