AZ-104 Implement and Manage Virtual Networking Practice Question
An on-premises application connected through a site-to-site VPN must read data from an Azure Storage account. Public network access is disabled on the storage account, and the storage service must be reachable only by a private IP address inside Azure. Which solution should the administrator implement?
⚠ Common exam trap
Watch out — candidates often confuse service endpoints with private endpoints: candidates often choose service endpoints because they also provide secure connectivity, but service endpoints do not assign a private IP and require public network access to be enabled, making them unsuitable when the requirement is to use only a private IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private endpoint for the storage account in an Azure VNet.
A private endpoint assigns the storage account a private IP address from an Azure VNet, allowing the on-premises application to connect over the site-to-site VPN using that private IP. This ensures the storage service is reachable only within Azure's private network, even with public network access disabled. The private endpoint uses Azure Private Link to securely expose the storage account into the VNet, making it accessible via the VPN without traversing the public internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable a service endpoint on the on-premises network.
Why it's wrong here
Service endpoints are an Azure subnet-level setting that extends the virtual network's identity to a PaaS service, so they must be enabled on an Azure VNet subnet, not on an on-premises network. They do not assign a private IP to the storage account and are not applicable to clients connecting through a site-to-site VPN. On-premises traffic would still be sent to the service's public endpoint, failing the private-access requirement.
When this WOULD be correct
A service endpoint would be correct when an Azure VM in a VNet needs to access a storage account with public network access disabled, and the VM's subnet has a service endpoint enabled for Microsoft.Storage. The storage account firewall is configured to allow access from that subnet.
- ✓
Create a private endpoint for the storage account in an Azure VNet.
Why this is correct
A private endpoint assigns the storage account a private IP address in a chosen Azure VNet, allowing access over private connectivity instead of the public internet. Because the on-premises application already reaches Azure through a site-to-site VPN, it can use that private path to access the endpoint when DNS is configured correctly. This meets the requirement to keep public access disabled while exposing the service privately.
- ✗
Peer the on-premises network directly to the storage account.
Why it's wrong here
Virtual network peering connects Azure VNets to other Azure VNets; it cannot be used to peer an on-premises network or a storage account, because a storage account is a PaaS service, not a virtual network. A site-to-site VPN already creates the hybrid connectivity to Azure, but peering would not provide a private IP for the storage account. Therefore, this option is not technically valid and does not satisfy the requirement.
When this WOULD be correct
An administrator needs to connect two Azure virtual networks in different regions to allow resources to communicate privately over the Microsoft backbone. VNet peering is the correct solution to enable low-latency, high-bandwidth connectivity between the VNets without a gateway.
- ✗
Use a shared access signature and leave public network access enabled.
Why it's wrong here
A shared access signature (SAS) only grants delegated authorization to specific storage resources; it does nothing to restrict the network path. Leaving public network access enabled means the account's public endpoint remains reachable over the internet, so the requirement to keep the service private is violated. Even if traffic from on-premises happens to traverse the VPN, the storage account is still publicly discoverable and accessible from other networks.
When this WOULD be correct
A shared access signature would be correct when you need to grant time-limited, delegated access to a storage account that has public network access enabled, and the client can connect over the internet. For example, allowing a remote user to upload a file to a blob container without requiring Azure credentials.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a private endpoint for the storage account in an Azure VNet.Correct answer▾
Why this is correct
A private endpoint assigns the storage account a private IP address in a chosen Azure VNet, allowing access over private connectivity instead of the public internet. Because the on-premises application already reaches Azure through a site-to-site VPN, it can use that private path to access the endpoint when DNS is configured correctly. This meets the requirement to keep public access disabled while exposing the service privately.
✗Enable a service endpoint on the on-premises network.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints are used to secure Azure service access from within a VNet, not from on-premises networks. The on-premises network cannot directly enable a service endpoint; it must be configured on a VNet subnet, and the storage account must allow access from that VNet. This does not provide a private IP address for the storage account.
★ When this WOULD be the correct answer
A service endpoint would be correct when an Azure VM in a VNet needs to access a storage account with public network access disabled, and the VM's subnet has a service endpoint enabled for Microsoft.Storage. The storage account firewall is configured to allow access from that subnet.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private connectivity. They might also believe that service endpoints can be extended to on-premises networks via VPN, which is incorrect.
✗Peer the on-premises network directly to the storage account.Wrong answer — click to see why▾
Why this is wrong here
VNet peering connects virtual networks, not on-premises networks directly to Azure services. The on-premises network must first be connected to an Azure VNet (e.g., via VPN or ExpressRoute), then peering can link VNets, but it does not provide private access to a storage account without a private endpoint or service endpoint.
★ When this WOULD be the correct answer
An administrator needs to connect two Azure virtual networks in different regions to allow resources to communicate privately over the Microsoft backbone. VNet peering is the correct solution to enable low-latency, high-bandwidth connectivity between the VNets without a gateway.
Why candidates choose this
Candidates may confuse VNet peering with site-to-site VPN connectivity, thinking that peering can directly connect an on-premises network to an Azure service, or they may incorrectly assume that peering provides private access to PaaS services like storage.
✗Use a shared access signature and leave public network access enabled.Wrong answer — click to see why▾
Why this is wrong here
Public network access is disabled on the storage account, so a shared access signature (SAS) cannot be used because SAS requires public endpoints to function. The requirement is to reach the storage account only by a private IP address, which SAS does not provide.
★ When this WOULD be the correct answer
A shared access signature would be correct when you need to grant time-limited, delegated access to a storage account that has public network access enabled, and the client can connect over the internet. For example, allowing a remote user to upload a file to a blob container without requiring Azure credentials.
Why candidates choose this
Candidates may think SAS is a secure way to grant access without exposing the account key, but they overlook that SAS still relies on the public endpoint and cannot bypass the public network access disabled setting.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.