AZ-104 Implement and Manage Storage Practice Question
An application on a VM in subnet AppSubnet must access a storage account over the public endpoint. The security team wants to allow traffic only from AppSubnet and does not want to deploy a private endpoint. What should the administrator configure?
⚠ Common exam trap
It's easy for candidates to confuse service endpoints with private endpoints, assuming that only private endpoints can restrict access, when in fact service endpoints combined with the storage account firewall can achieve subnet-level restriction over the public endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Microsoft.Storage service endpoint on AppSubnet and allow that virtual network in the storage account firewall.
Enabling a Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, while still using the public endpoint. Then, configuring the storage account firewall to allow that virtual network restricts access exclusively to AppSubnet, meeting the security requirement without deploying a private endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the storage account firewall and rely on the VM's source IP address.
Why it's wrong here
Disabling the storage account firewall removes all default network restrictions, which allows any network—not just AppSubnet—to reach the account, directly violating the requirement. The VM's source IP address, even if static, would only identify an individual VM and not the entire AppSubnet; to scope by subnet you must use virtual network-based rules or service endpoints. Disabling the firewall also turns off the ability to define any source-based restrictions, so relying on a source IP is both contradictory and insufficient for subnet-level control.
When this WOULD be correct
This option would be correct if the question stated that the VM has a static public IP and the security team explicitly wants to allow only that specific IP address, and there is no requirement to allow traffic from the entire subnet or use service endpoints.
- ✓
Enable the Microsoft.Storage service endpoint on AppSubnet and allow that virtual network in the storage account firewall.
Why this is correct
A service endpoint extends the subnet identity to the storage service while still using the public endpoint, which matches the requirement to avoid a private endpoint. After enabling the endpoint on AppSubnet, you can allow that virtual network in the storage account firewall so only traffic from the approved subnet can reach the account. This is a common network-control pattern for Azure Storage.
- ✗
Create a private endpoint and leave the firewall set to allow all networks.
Why it's wrong here
This option directly contradicts the stated requirement to avoid deploying a private endpoint, so it cannot be the correct solution. Even if a private endpoint were acceptable, leaving the firewall set to allow all networks means the storage account's public endpoint stays open to every internet source, completely negating the goal of restricting access to only AppSubnet. A private endpoint gives private IP connectivity, but it does not automatically close the public endpoint; the firewall must also be explicitly locked down to specific networks.
When this WOULD be correct
If the question required secure, private connectivity to the storage account without exposing it to the public internet, and the organization was willing to deploy a private endpoint, then option C would be correct. For example: 'An application on a VM must access a storage account privately, bypassing the public endpoint. What should be configured?'
- ✗
Grant the VM Contributor access to the storage account and the network rule will be enforced automatically.
Why it's wrong here
Granting the VM's managed identity or the VM Contributor role on the storage account controls Azure RBAC management-plane permissions, not network reachability. Network rules on the storage account firewall operate at the network layer, filtering by source virtual network or IP address; they are completely independent of any RBAC role assignments. Contributor does not authorize data-plane access, nor does it cause traffic to originate from AppSubnet, so no network rule is automatically enforced simply because of that role.
When this WOULD be correct
This option would be correct if the question asked: 'An administrator needs to allow a VM to manage a storage account (e.g., create containers) without using the Azure portal. What should be configured?' In that case, assigning the Contributor role to the VM's managed identity would grant the necessary permissions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable the Microsoft.Storage service endpoint on AppSubnet and allow that virtual network in the storage account firewall.Correct answer▾
Why this is correct
A service endpoint extends the subnet identity to the storage service while still using the public endpoint, which matches the requirement to avoid a private endpoint. After enabling the endpoint on AppSubnet, you can allow that virtual network in the storage account firewall so only traffic from the approved subnet can reach the account. This is a common network-control pattern for Azure Storage.
✗Disable the storage account firewall and rely on the VM's source IP address.Wrong answer — click to see why▾
Why this is wrong here
The security team wants to allow traffic only from AppSubnet, not from any specific VM IP. Relying on the VM's source IP would require managing individual IPs and does not scale; also, the storage account firewall can be configured to allow a virtual network, which is more secure and manageable.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the VM has a static public IP and the security team explicitly wants to allow only that specific IP address, and there is no requirement to allow traffic from the entire subnet or use service endpoints.
Why candidates choose this
Candidates may think that allowing the VM's IP is sufficient and simpler, not realizing that service endpoints provide a more secure and scalable way to restrict access to a specific subnet without exposing the storage account to the public internet.
✗Create a private endpoint and leave the firewall set to allow all networks.Wrong answer — click to see why▾
Why this is wrong here
The security team explicitly does not want to deploy a private endpoint, so creating one contradicts the requirement. Additionally, leaving the firewall set to allow all networks would not restrict traffic to only AppSubnet.
★ When this WOULD be the correct answer
If the question required secure, private connectivity to the storage account without exposing it to the public internet, and the organization was willing to deploy a private endpoint, then option C would be correct. For example: 'An application on a VM must access a storage account privately, bypassing the public endpoint. What should be configured?'
Why candidates choose this
Candidates may think a private endpoint is the only secure way to restrict access, overlooking service endpoints as a simpler alternative that meets the requirement of using the public endpoint.
✗Grant the VM Contributor access to the storage account and the network rule will be enforced automatically.Wrong answer — click to see why▾
Why this is wrong here
Granting Contributor access to the VM does not enforce network rules; it only allows the VM to manage the storage account. The storage account firewall requires explicit network rules (like service endpoints) to restrict traffic by source network, not by RBAC role.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'An administrator needs to allow a VM to manage a storage account (e.g., create containers) without using the Azure portal. What should be configured?' In that case, assigning the Contributor role to the VM's managed identity would grant the necessary permissions.
Why candidates choose this
Candidates may confuse RBAC roles with network security controls, thinking that granting Contributor access automatically includes network-level permission to access the storage account's public endpoint.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.