AZ-104 Implement and Manage Storage Practice Question
A team has an existing storage account with the public endpoint enabled. They want to allow access only from a specific subnet in a virtual network, but they do not want to create a private endpoint or manage private DNS zones. Which configuration should the administrator use?
⚠ Common exam trap
Candidates often confuse service endpoints with private endpoints, thinking both require private DNS management, or mistakenly believe that a SAS token can be scoped to a network source, when in fact SAS tokens only control access to data operations, not network-level restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.
Enabling a service endpoint for Microsoft.Storage on the subnet allows traffic from that subnet to the storage account over the Azure backbone network, and then adding the subnet to the storage account's network rules restricts access to only that subnet while keeping the public endpoint enabled. This meets the requirement of not using a private endpoint or managing private DNS zones.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.
Why this is correct
This is the correct pattern when you want to keep using the public endpoint while restricting traffic to a specific subnet. The service endpoint identifies the subnet as trusted, and the storage account firewall can then allow that subnet explicitly. It avoids the overhead of private endpoint DNS management while still reducing exposure.
- ✗
Create a private endpoint and disable the public endpoint.
Why it's wrong here
Creating a private endpoint requires provisioning a NIC with a private IP in a virtual network and configuring private DNS zones (or manual DNS records) to route the storage account FQDN to that endpoint. Disabling the public endpoint would cut off all internet-routable access, including the existing subnet's traffic, unless traffic is redirected through the private endpoint. The scenario explicitly excludes private endpoint and private DNS management, so this approach is out of scope even though it is a valid security pattern.
- ✗
Assign a SAS token to the subnet so only resources there can connect.
Why it's wrong here
A SAS token is an authorization mechanism that grants delegated access to storage resources (blobs, files, queues, tables) at the data plane, either with an account-level or service-level signature. It does not, by itself, filter traffic by source subnet or IP, and a leaked token can be used from anywhere; even an IP-restricted SAS has a limited IP range rather than an Azure subnet identity. This option conflates data-plane authentication with network-layer access control, so it cannot enforce subnet-only connectivity.
- ✗
Use an Azure Policy assignment to block public traffic to the storage account.
Why it's wrong here
Azure Policy is a governance tool that evaluates resource configuration for compliance and can deny or audit changes to a storage account's public network access setting, but it does not create the network-level allow rule for a specific subnet. If you assign a policy to deny public traffic, it would not automatically permit the subnet through the storage firewall; you would still need to add a service endpoint and a virtual network rule. Policy alone cannot establish the trusted network path that the question requires, so it is not a substitute for configuring storage account networking.
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A storage account must stay reachable through its public endpoint, but only Azure workloads in AppSubnet should be allowed to access it. No private IP is required. What should you configure?
easy- A.A private endpoint in AppSubnet.
- ✓ B.A service endpoint on AppSubnet and a storage firewall VNet rule.
- C.A VPN gateway between AppSubnet and the storage account.
- D.A public IP address on the storage account.
Why B: A service endpoint on AppSubnet extends the Azure backbone network to the subnet, allowing traffic to the storage account's public endpoint without a private IP. The storage firewall VNet rule then restricts access to only traffic originating from that specific subnet, meeting the requirement of public endpoint reachability with Azure workload-only access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.