AZ-104 Implement and Manage Virtual Networking Practice Question
An organization has an Azure Storage account that must be reachable from Azure VMs and from an on-premises application. Internet access to the storage account must be disabled, and the service should be accessible only over private IP paths. Which solution best meets the requirement?
⚠ Common exam trap
Watch out — candidates often confuse service endpoints with private endpoints, thinking service endpoints also provide private-only access, but service endpoints still use the public endpoint and do not block internet access by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a private endpoint for the storage account and connect on-premises through a site-to-site VPN or ExpressRoute path.
A private endpoint assigns the storage account a private IP address from the Azure VNet, making it accessible over a private IP path. On-premises connectivity is achieved via a site-to-site VPN or ExpressRoute, which extends the private network. This configuration disables internet access by blocking the public endpoint, meeting the requirement to disable internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable a service endpoint on the Azure VNet and keep the storage account public endpoint enabled.
Why it's wrong here
A service endpoint gives the storage account a source VNet identity for traffic originating inside the VNet, but it does not assign a private IP to the storage account and leaves the public endpoint fully functional. Because the public endpoint remains enabled, the account is still reachable from the internet unless you add separate firewall restrictions, and the service endpoint alone offers no private path for on-premises clients without additional VPN/ExpressRoute connectivity. It therefore meets neither the private connectivity nor the no-public-access requirement.
When this WOULD be correct
If the requirement were to restrict access to Azure VMs only (no on-premises) and allow internet access to be blocked via firewall rules, enabling a service endpoint on the VNet and configuring the storage firewall to deny all but that VNet would be correct.
- ✓
Use a private endpoint for the storage account and connect on-premises through a site-to-site VPN or ExpressRoute path.
Why this is correct
A private endpoint gives the storage account a private IP in a VNet, which keeps traffic off the public internet. Because the on-premises application also needs access, the on-premises network must have private connectivity to that VNet, typically through a site-to-site VPN gateway or ExpressRoute. This design satisfies both private access and the no-public-access requirement.
- ✗
Use VNet peering only and leave the storage account firewall open to selected public IPs.
Why it's wrong here
VNet peering only connects virtual networks to each other and does nothing to move the storage account off its public endpoint. Because the storage account remains a publicly addressable service, leaving its firewall open to selected public IPs still allows internet-routable traffic and does not provide any private connectivity for on-premises clients. This option fails both the private-path and no-public-access requirements.
When this WOULD be correct
If the requirement was to connect two Azure VNets to access a storage account without traversing the internet, and on-premises access was not needed, VNet peering with firewall rules allowing traffic from the peered VNet's private IPs would be correct.
- ✗
Assign a public IP address to the storage account and restrict access with an NSG.
Why it's wrong here
You cannot assign a public IP address to a storage account, as it is an Azure PaaS resource instead of a VM or load balancer, and NSGs only apply to subnets or network interfaces, not to storage accounts. Even if this were possible, granting a public IP would inherently make the storage account reachable from the internet, directly violating the requirement that it not be accessible from the internet. This is architecturally invalid and also fails the security constraint.
When this WOULD be correct
This option would be correct if the question asked about securing an Azure VM's outbound traffic to the internet, where assigning a public IP to the VM and applying an NSG to its subnet can control inbound/outbound access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use a private endpoint for the storage account and connect on-premises through a site-to-site VPN or ExpressRoute path.Correct answer▾
Why this is correct
A private endpoint gives the storage account a private IP in a VNet, which keeps traffic off the public internet. Because the on-premises application also needs access, the on-premises network must have private connectivity to that VNet, typically through a site-to-site VPN gateway or ExpressRoute. This design satisfies both private access and the no-public-access requirement.
✗Enable a service endpoint on the Azure VNet and keep the storage account public endpoint enabled.Wrong answer — click to see why▾
Why this is wrong here
Keeping the storage account public endpoint enabled violates the requirement to disable internet access; service endpoints still use the public endpoint, just with network rules.
★ When this WOULD be the correct answer
If the requirement were to restrict access to Azure VMs only (no on-premises) and allow internet access to be blocked via firewall rules, enabling a service endpoint on the VNet and configuring the storage firewall to deny all but that VNet would be correct.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking that service endpoints provide private IP connectivity, when they actually still use the public endpoint with added network restrictions.
✗Use VNet peering only and leave the storage account firewall open to selected public IPs.Wrong answer — click to see why▾
Why this is wrong here
VNet peering only connects VNets within Azure, not on-premises networks. Leaving the firewall open to selected public IPs still exposes the storage account to the internet, violating the requirement to disable internet access.
★ When this WOULD be the correct answer
If the requirement was to connect two Azure VNets to access a storage account without traversing the internet, and on-premises access was not needed, VNet peering with firewall rules allowing traffic from the peered VNet's private IPs would be correct.
Why candidates choose this
Candidates may think VNet peering provides private connectivity and that firewall IP restrictions are sufficient, overlooking that on-premises connectivity requires additional private paths like VPN or ExpressRoute.
✗Assign a public IP address to the storage account and restrict access with an NSG.Wrong answer — click to see why▾
Why this is wrong here
Assigning a public IP to a storage account is not supported; storage accounts use a public endpoint by default. NSGs cannot be applied to a storage account, only to subnets or NICs, and this would not disable internet access.
★ When this WOULD be the correct answer
This option would be correct if the question asked about securing an Azure VM's outbound traffic to the internet, where assigning a public IP to the VM and applying an NSG to its subnet can control inbound/outbound access.
Why candidates choose this
Candidates may mistakenly think that a public IP and NSG can be applied to a storage account like a VM, and that restricting with NSG is equivalent to disabling internet access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A team wants an Azure VM in a subnet to reach a storage account securely without opening the account to the entire internet. Which two configuration choices can be used to achieve this? Select two.
easy- ✓ A.Private endpoint
- ✓ B.Service endpoint
- C.Enable anonymous blob access
- D.Move the account to the Archive tier
- E.Apply a delete lock to the storage account
Why A: Private endpoint (A) assigns a private IP address from the VM's subnet to the storage account, enabling secure connectivity over the Microsoft backbone network without exposing the account to the public internet. Service endpoint (B) extends the virtual network identity to the storage account via its public endpoint but restricts access to traffic originating from the specified subnet, also avoiding full internet exposure. Both options satisfy the requirement for secure, subnet-restricted access.
Variation 2. A storage account must be reachable only from resources in a single VNet. The team wants the storage service to use a private IP address inside that VNet and wants to disable public network access. Which feature should be configured?
medium- A.A service endpoint
- ✓ B.A private endpoint
- C.A network security group rule on the subnet
- D.A storage account firewall IP allow rule
Why B: A private endpoint assigns the storage account a private IP address from the VNet's address space, effectively bringing the service into the VNet. It also disables public network access by default when configured with the 'Deny public network access' setting, ensuring the storage account is reachable only from within that VNet.
Variation 3. A storage account must be reachable only from resources in a specific Azure subnet, and connections must not use the public endpoint. Which option should the administrator configure?
medium- A.A service endpoint on the subnet, because it keeps traffic on the Azure backbone.
- ✓ B.A private endpoint for the storage account in the subnet.
- C.A NAT gateway attached to the subnet.
- D.A storage firewall rule that allows all Azure services.
Why B: A private endpoint assigns the storage account a private IP address from the subnet, effectively bringing the service into the virtual network. This ensures all traffic to the storage account stays within the Microsoft Azure backbone and never traverses the public internet, meeting the requirement that connections must not use the public endpoint.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.