AZ-104 Implement and Manage Virtual Networking Practice Question
An application running on a VM in a subnet must access an Azure Storage account. The security team wants the storage account to accept traffic only from that subnet, but they do not want a private IP address in the VNet and they do not want to change DNS records. What should the administrator configure?
⚠ Common exam trap
Candidates often confuse service endpoints with private endpoints, assuming that any restriction to a VNet requires a private IP address, but service endpoints achieve subnet-level restriction using the public endpoint without private IPs or DNS changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet.
A service endpoint for Microsoft.Storage allows the subnet to send traffic to the storage account over the Azure backbone network using the storage account's public endpoint, without requiring a private IP address or DNS changes. The storage firewall then restricts access to only that subnet's traffic, meeting the security team's requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a private endpoint and a private DNS zone for the storage account.
Why it's wrong here
A private endpoint assigns the storage account a private IP address within the VNet and requires a private DNS zone to redirect name resolution to that address. This changes the network topology to a private IP in the VNet, which the scenario explicitly avoids, since the requirement is subnet-only access without creating a private IP. It also introduces additional complexity around DNS zone linking and lifecycle management that service endpoints do not require.
When this WOULD be correct
This option would be correct if the question required the storage account to be accessible only from a specific VNet using a private IP address, and the candidate was allowed to manage DNS records (e.g., by creating a private DNS zone). For example: 'An application on a VM must access a storage account using a private IP to avoid traversing the internet. The team can update DNS records. What should they configure?'
- ✓
Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet.
Why this is correct
A service endpoint extends the subnet identity to the Azure Storage service without creating a private IP address in the VNet. It also avoids DNS changes because clients continue to use the normal public endpoint name, while the storage firewall can be configured to allow only the selected subnet. This matches the requirement for subnet-only access while keeping the service on its public endpoint architecture.
- ✗
Allow access only from the VM public IP address.
Why it's wrong here
Configuring the storage firewall to allow only the VM's public IP address restricts access to that specific IP, not the subnet as a whole. If the VM is deallocated and restarted (or recreated), the public IP can change, breaking access. It also requires the VM to have a public IP, which is unnecessary and less secure than a service endpoint that binds the subnet identity directly to the storage account.
When this WOULD be correct
If the question required restricting access to a storage account from a specific VM with a static public IP, and the security team was okay with using public IP addresses without subnet-level restrictions, then configuring the storage firewall to allow only that VM's public IP would be correct.
- ✗
Place the storage account in the same resource group as the VM.
Why it's wrong here
Resource-group placement is a logical management boundary, not a network security control. Putting the VM and storage account in the same resource group has no effect on the storage account's network rules, which govern whether the subnet can reach it. Access is controlled by service endpoints, firewall rules, and RBAC, none of which are influenced by resource-group membership.
When this WOULD be correct
An administrator needs to apply the same tag to a storage account and a VM for cost tracking, and the question specifies that resources in the same resource group should inherit a policy requiring that tag.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet.Correct answer▾
Why this is correct
A service endpoint extends the subnet identity to the Azure Storage service without creating a private IP address in the VNet. It also avoids DNS changes because clients continue to use the normal public endpoint name, while the storage firewall can be configured to allow only the selected subnet. This matches the requirement for subnet-only access while keeping the service on its public endpoint architecture.
✗Create a private endpoint and a private DNS zone for the storage account.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly states the security team does not want a private IP address in the VNet and does not want to change DNS records. A private endpoint assigns a private IP to the storage account within the VNet and requires a private DNS zone to resolve the storage account FQDN to that private IP, which violates both constraints.
★ When this WOULD be the correct answer
This option would be correct if the question required the storage account to be accessible only from a specific VNet using a private IP address, and the candidate was allowed to manage DNS records (e.g., by creating a private DNS zone). For example: 'An application on a VM must access a storage account using a private IP to avoid traversing the internet. The team can update DNS records. What should they configure?'
Why candidates choose this
Candidates may confuse private endpoints with service endpoints, thinking both provide subnet-level access control. They might also overlook the explicit constraints about private IP and DNS changes, focusing only on the requirement to restrict access to a subnet.
✗Allow access only from the VM public IP address.Wrong answer — click to see why▾
Why this is wrong here
The security team does not want to change DNS records, and using the VM's public IP address would require the storage account to accept traffic from that public IP, which is not restricted to the subnet and does not leverage Azure's network infrastructure for secure access.
★ When this WOULD be the correct answer
If the question required restricting access to a storage account from a specific VM with a static public IP, and the security team was okay with using public IP addresses without subnet-level restrictions, then configuring the storage firewall to allow only that VM's public IP would be correct.
Why candidates choose this
Candidates may think that restricting by public IP is a straightforward way to limit access, overlooking the requirement for subnet-level restriction and the desire to avoid public IP exposure.
✗Place the storage account in the same resource group as the VM.Wrong answer — click to see why▾
Why this is wrong here
Placing the storage account in the same resource group as the VM does not restrict network access; resource groups are logical containers and do not enforce network security.
★ When this WOULD be the correct answer
An administrator needs to apply the same tag to a storage account and a VM for cost tracking, and the question specifies that resources in the same resource group should inherit a policy requiring that tag.
Why candidates choose this
Candidates may mistakenly think that same resource group implies same network or security boundary, confusing logical grouping with network segmentation.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A VM in a subnet must access an Azure Storage account without creating a private endpoint. The organization is fine with the storage account remaining on its public endpoint, but traffic should stay on the Azure backbone rather than the public internet. Which feature should you use?
medium- ✓ A.A service endpoint for Microsoft.Storage on the subnet.
- B.A private endpoint and a private DNS zone.
- C.A NAT gateway attached to the subnet.
- D.A VPN gateway connection to the storage account resource group.
Why A: A service endpoint for Microsoft.Storage on the subnet extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to traverse the Azure backbone network instead of the public internet. This meets the requirement of keeping traffic on the Azure backbone without creating a private endpoint, as service endpoints use the public endpoint but route traffic through Microsoft's network.
Variation 2. A team wants one subnet to access an existing Storage account over its public endpoint. They do not want a private IP for the account or any DNS changes, but they want to block access from all other subnets. What should the administrator configure?
medium- A.Create a private endpoint and disable public network access on the storage account.
- ✓ B.Enable a service endpoint on the subnet and add a virtual network rule on the storage account.
- C.Assign the Storage Blob Data Reader role to the subnet.
- D.Associate a route table with a default route to the storage account private IP.
Why B: A service endpoint extends the virtual network's identity to the Azure Storage service, allowing the subnet to access the storage account over its public endpoint without requiring a private IP or DNS changes. By enabling a service endpoint on the subnet and adding a virtual network rule on the storage account, you restrict access to only that subnet while blocking all other subnets, meeting the team's requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.