AZ-104 Implement and Manage Storage Practice Question
An application runs on an Azure VM in a subnet and must access a storage account over the public endpoint without using a private IP address. The administrator wants to restrict access so only that subnet can reach the account. What should be configured?
⚠ Common exam trap
A common mix-up: candidates confuse service endpoints with private endpoints, assuming that restricting access to a subnet requires a private IP, when service endpoints can achieve subnet-level restriction over the public endpoint without changing the IP addressing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.
A service endpoint for Microsoft.Storage extends the virtual network identity to the subnet, allowing the storage account firewall to accept traffic from that subnet via its public endpoint. This meets the requirement of restricting access to the storage account's public endpoint without using a private IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a private endpoint for the storage account and disable the public endpoint.
Why it's wrong here
A private endpoint deploys a network interface with a private IP from your VNet into the subnet, giving the storage account a private identity inside the network. The requirement explicitly prohibits the storage account from having a private IP, so this violates the constraint. It also typically requires disabling the public endpoint, which would prevent any future access from the internet or other non-VNet clients. While it does restrict access to the subnet, the service endpoint approach achieves the same without a private IP.
When this WOULD be correct
When the requirement is to access the storage account using a private IP address from the subnet, ensuring traffic never traverses the public internet. For example, an application must access storage with low latency and enhanced security by keeping traffic within the Microsoft backbone.
- ✓
Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.
Why this is correct
A service endpoint lets the subnet reach the storage account over the Azure backbone while still using the storage account's public endpoint. Adding the subnet to the storage firewall allows only that subnet to connect. This meets the requirement to avoid a private IP while restricting access to a specific subnet.
- ✗
Allow trusted Microsoft services to bypass the firewall.
Why it's wrong here
The 'Allow trusted Microsoft services to bypass this firewall' exception is designed for specific Microsoft PaaS services that need to reach the account for diagnostics or support, not for arbitrary VNet workloads. Enabling it would permit a broad set of Microsoft services to bypass the firewall, which is far less restrictive than limiting access to your one application subnet. In addition, traffic from an Azure VM running your application is not considered a trusted Microsoft service, so this setting would not even enable the VM's connection. It therefore fails both the access-restriction and the subnet-specific requirements.
When this WOULD be correct
A question where the storage account has a firewall enabled, and the administrator needs to allow specific Azure platform services (e.g., Azure Backup, Azure Site Recovery) to access the storage account for operational purposes, without exposing it to all internet traffic.
- ✗
Add a user-defined route that points storage traffic to the virtual network gateway.
Why it's wrong here
A user-defined route only changes the next hop for traffic destined to the storage account's public IP, for example forcing it through a virtual network gateway. This does not grant, deny, or scope authorization at the storage account level; the storage account's network rules still evaluate the source IP on the packet. If the subnet isn't in the firewall allow list, the request will be rejected regardless of the route. Further, routing storage traffic through a gateway introduces latency and does not provide any subnet-scoped identity that the storage firewall could use.
When this WOULD be correct
An organization has a hub-and-spoke network topology and wants to force all outbound traffic from a spoke subnet to the internet through a central firewall (NVA) in the hub. In this case, a UDR with next hop set to the virtual appliance would be correct to enforce security inspection.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.Correct answer▾
Why this is correct
A service endpoint lets the subnet reach the storage account over the Azure backbone while still using the storage account's public endpoint. Adding the subnet to the storage firewall allows only that subnet to connect. This meets the requirement to avoid a private IP while restricting access to a specific subnet.
✗Create a private endpoint for the storage account and disable the public endpoint.Wrong answer — click to see why▾
Why this is wrong here
The question requires access over the public endpoint, but a private endpoint assigns a private IP address from the subnet, bypassing the public endpoint entirely. This contradicts the requirement to use the public endpoint.
★ When this WOULD be the correct answer
When the requirement is to access the storage account using a private IP address from the subnet, ensuring traffic never traverses the public internet. For example, an application must access storage with low latency and enhanced security by keeping traffic within the Microsoft backbone.
Why candidates choose this
Candidates often confuse private endpoints with service endpoints, thinking both restrict access to a subnet, but private endpoints use private IPs and disable public access, which is not what the question asks.
✗Allow trusted Microsoft services to bypass the firewall.Wrong answer — click to see why▾
Why this is wrong here
The question requires restricting access to the storage account's public endpoint to only a specific subnet. Allowing trusted Microsoft services bypasses the firewall, which would grant access to other Azure services (e.g., Azure Backup, Azure Logic Apps) that are not part of the subnet, violating the restriction.
★ When this WOULD be the correct answer
A question where the storage account has a firewall enabled, and the administrator needs to allow specific Azure platform services (e.g., Azure Backup, Azure Site Recovery) to access the storage account for operational purposes, without exposing it to all internet traffic.
Why candidates choose this
Candidates may think that enabling trusted Microsoft services is a way to allow access from within Azure, but they overlook that this option grants broad access to many Azure services, not just the specific subnet required in the question.
✗Add a user-defined route that points storage traffic to the virtual network gateway.Wrong answer — click to see why▾
Why this is wrong here
A user-defined route (UDR) directing storage traffic to a virtual network gateway would force traffic through the gateway, but the question requires access over the public endpoint without using a private IP. UDRs do not restrict access to a specific subnet; they only control routing, not firewall rules.
★ When this WOULD be the correct answer
An organization has a hub-and-spoke network topology and wants to force all outbound traffic from a spoke subnet to the internet through a central firewall (NVA) in the hub. In this case, a UDR with next hop set to the virtual appliance would be correct to enforce security inspection.
Why candidates choose this
Candidates may confuse routing control with access control, thinking that directing traffic through a gateway or appliance can restrict access, or they may overcomplicate the solution by adding unnecessary routing when a simple service endpoint suffices.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Service endpoint
A service endpoint is a specific network address (URL or IP/port) that client applications use to access the functionality or data of a cloud or web service.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.