An application VM in a subnet without a public IP must access Azure Blob Storage. The storage account must not be reachable from the public internet, and DNS resolution should stay inside the virtual network. What should you implement?

Enable a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Service endpoints do not create a private IP and still rely on the storage service's public endpoint.

Use a SAS token and allow access from any network for the storage account.

A SAS token controls authorization, but it does not keep the storage account off the public internet.

Assign a managed identity to the VM and remove all network restrictions from the storage account.

Managed identity simplifies authentication, but it does not provide private network access by itself.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a private endpoint for the storage account and link the appropriate private DNS zone. — A private endpoint is the right choice when a PaaS service must be reachable through a private IP inside a VNet. For Azure Blob Storage, it avoids exposure to the public internet while still allowing the VM to connect privately. Linking the private DNS zone ensures the storage name resolves to the private IP, so the application uses the private path transparently. Why others are wrong: Service endpoints extend VNet identity to the service but still use the public service endpoint, so they do not meet the private IP requirement. SAS tokens only provide temporary authorization and do not change network exposure. Managed identities are useful for authentication, but they do not replace the need for private connectivity or DNS integration.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.