AZ-104 Implement and Manage Virtual Networking Practice Question
An existing application in AppSubnet1 must access an Azure Storage account. The team does not want to add a private endpoint or change DNS records, but they do want to allow access only from AppSubnet1. Which configuration should the administrator use?
⚠ Common exam trap
Test-takers frequently confuse service endpoints with private endpoints, assuming both require DNS changes, or they mistakenly think NSG rules alone can restrict inbound access to a PaaS service, when in fact the storage account firewall must be explicitly configured to accept traffic only from the specified subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Microsoft.Storage service endpoint on AppSubnet1 and restrict the storage account to selected virtual networks.
Enabling the Microsoft.Storage service endpoint on AppSubnet1 allows traffic from that subnet to be routed directly to the Azure Storage service over the Azure backbone network, bypassing the internet. By then restricting the storage account's firewall to 'selected virtual networks' and adding AppSubnet1's virtual network and subnet, access is limited exclusively to that subnet without needing a private endpoint or DNS changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the Microsoft.Storage service endpoint on AppSubnet1 and restrict the storage account to selected virtual networks.
Why this is correct
A service endpoint lets traffic from the subnet reach the storage account over the Azure backbone while the storage firewall can allow only that subnet. This matches the requirement to avoid private endpoints and DNS changes. The access is still limited to the approved subnet identity, which is what the storage firewall evaluates.
- ✗
Create a private endpoint and remove all public network access from the storage account.
Why it's wrong here
A private endpoint gives the storage account a private IP address within an Azure VNet, and removing all public network access ensures that only traffic to that private IP is accepted. But this approach requires creating and linking a private DNS zone, updating the DNS resolution (and often connection strings) for the application, and possibly adjusting routing—all of which the scenario explicitly says are not required because they want to avoid private endpoints. Additionally, a private endpoint is scoped to a particular subnet that hosts the endpoint, so the application's subnet would need to be that subnet, but the requirement is to secure access from AppSubnet1, which could be accomplished more simply with a service endpoint. Therefore, this is a valid but misaligned solution that introduces unnecessary complexity and contradicts the stated constraint of not requiring private endpoints.
When this WOULD be correct
If the question required the most secure method to ensure no public internet access and allowed adding a private endpoint, then creating a private endpoint and removing all public network access would be correct.
- ✗
Add a network security group rule that allows outbound TCP 443 to the storage account.
Why it's wrong here
A network security group rule only filters traffic allowed to enter or leave a subnet or NIC based on source/destination IP, port, and protocol, and it does not grant any service-level permissions. The storage account enforces its own firewall, which by default denies all traffic unless the source is explicitly allowed via a public IP range or a selected virtual network. Adding an outbound rule for TCP 443 merely permits the packet to leave the subnet; when it reaches the storage account's endpoint, the storage firewall still evaluates the source and rejects it because the subnet is not a selected VNet. Thus, an NSG rule is both necessary and insufficient—without configuring the storage firewall to allow AppSubnet1, outbound access alone will not work.
When this WOULD be correct
If the question asked how to ensure outbound connectivity from a subnet to a storage account over HTTPS while blocking other outbound traffic, adding an NSG rule allowing outbound TCP 443 to the storage account's service tag (e.g., AzureCloud) would be correct.
- ✗
Enable peering between AppSubnet1 and the storage account network.
Why it's wrong here
VNet peering establishes connectivity between virtual networks, allowing IP-level routing between resources in those VNets. However, Azure Storage is a multi-tenant PaaS service that does not reside inside a VNet, so there is no storage account network to peer with, and peering alone does not apply any subnet-based access control. Even if you peered AppSubnet1 with another VNet that contains a storage service, you would still need an explicit service endpoint or private endpoint configuration to allow the storage account to accept traffic from that subnet. In short, VNet peering does not change the storage account's public endpoint or default deny firewall settings, so it fails the requirement.
When this WOULD be correct
When two virtual networks need to communicate privately and directly, such as connecting a subnet in VNet1 to a subnet in VNet2 to allow traffic without going over the internet or using a VPN gateway.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable the Microsoft.Storage service endpoint on AppSubnet1 and restrict the storage account to selected virtual networks.Correct answer▾
Why this is correct
A service endpoint lets traffic from the subnet reach the storage account over the Azure backbone while the storage firewall can allow only that subnet. This matches the requirement to avoid private endpoints and DNS changes. The access is still limited to the approved subnet identity, which is what the storage firewall evaluates.
✗Create a private endpoint and remove all public network access from the storage account.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly states the team does not want to add a private endpoint, so option B violates that constraint.
★ When this WOULD be the correct answer
If the question required the most secure method to ensure no public internet access and allowed adding a private endpoint, then creating a private endpoint and removing all public network access would be correct.
Why candidates choose this
Candidates may think private endpoint is the only way to restrict access to a subnet, overlooking service endpoints as a simpler solution when DNS changes are not desired.
✗Add a network security group rule that allows outbound TCP 443 to the storage account.Wrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) rule controls traffic at the subnet or NIC level but does not restrict access to the storage account itself; the storage account would still be publicly accessible from any IP, so it does not meet the requirement to allow access only from AppSubnet1.
★ When this WOULD be the correct answer
If the question asked how to ensure outbound connectivity from a subnet to a storage account over HTTPS while blocking other outbound traffic, adding an NSG rule allowing outbound TCP 443 to the storage account's service tag (e.g., AzureCloud) would be correct.
Why candidates choose this
Candidates may think that controlling outbound traffic with an NSG is sufficient to restrict access to the storage account, not realizing that NSGs do not enforce inbound restrictions on the storage account itself.
✗Enable peering between AppSubnet1 and the storage account network.Wrong answer — click to see why▾
Why this is wrong here
Enabling peering between AppSubnet1 and the storage account network is not possible because Azure Storage accounts do not have a virtual network to peer with; peering is only between virtual networks.
★ When this WOULD be the correct answer
When two virtual networks need to communicate privately and directly, such as connecting a subnet in VNet1 to a subnet in VNet2 to allow traffic without going over the internet or using a VPN gateway.
Why candidates choose this
Candidates may confuse peering with service endpoints or private endpoints, thinking that peering can provide direct network connectivity to a storage account, similar to how it connects VNets.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Service endpoint
A service endpoint is a specific network address (URL or IP/port) that client applications use to access the functionality or data of a cloud or web service.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.