Using Private Endpoints to Access Azure Storage Privately over VPN
An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Blob Storage account over a private IP, and the storage account must not accept public network traffic. Which configuration should the administrator deploy?
Quick Answer
The answer is to deploy a private endpoint for the storage account within an Azure VNet that is reachable through the existing site-to-site VPN. This configuration works because a private endpoint assigns the storage account a private IP address from the VNet, allowing the on-premises application to connect over the VPN without traversing the public internet, while the storage account’s firewall can then disable all public network traffic. On the AZ-104 exam, this scenario tests your understanding of how private endpoints enforce network isolation and integrate with hybrid connectivity like VPNs; a common trap is confusing a service endpoint, which still uses public IPs and requires public access to be enabled. Remember the key distinction: private endpoints give a private IP, service endpoints do not. For a memory tip, think “Private IP for Private Access” — if the requirement is a private IP and no public traffic, always choose the private endpoint.
⚠ Common exam trap
Watch out — candidates often confuse service endpoints with private endpoints, assuming both provide private IP access, but only private endpoints remove the public endpoint entirely, which is necessary when public network access must be disabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint for the storage account in an Azure VNet reachable through the VPN.
A private endpoint assigns the storage account a private IP from an Azure VNet, making it accessible over the site-to-site VPN without traversing the public internet. This satisfies the requirement for private IP access and allows the storage account to block all public network traffic by disabling public network access in the firewall settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service endpoint on the on-premises network and a storage account firewall exception.
Why it's wrong here
Service endpoints only extend Azure virtual network identity to supported services and do not provide a private IP for on-premises clients.
When this WOULD be correct
This option would be correct if the requirement was to allow access from an on-premises network to an Azure storage account over the public internet, but restrict access to only the on-premises public IP. For example, if the storage account must accept public network traffic but only from a specific on-premises IP range.
- ✓
A private endpoint for the storage account in an Azure VNet reachable through the VPN.
Why this is correct
A private endpoint gives the storage account a private IP address inside a VNet. Because the on-premises network already reaches Azure through a site-to-site VPN, on-prem clients can reach that private IP over the encrypted tunnel, provided DNS is also configured to resolve the private name correctly. This satisfies both goals: private connectivity and no public network access to the storage account.
- ✗
A NAT gateway on the subnet that hosts the storage account.
Why it's wrong here
A NAT gateway affects outbound internet translation from subnets, not private access to storage accounts.
When this WOULD be correct
A NAT gateway would be correct when you need to provide outbound internet access to resources in a private subnet (e.g., for updates or external API calls) while keeping them isolated from inbound internet traffic. For example, a question requiring outbound-only access for a VM without public IPs.
- ✗
An application security group applied to the storage account.
Why it's wrong here
Application security groups are for VM NIC targeting in NSG rules and do not apply to storage accounts.
When this WOULD be correct
An administrator needs to control network traffic between groups of VMs in a VNet, such as allowing web tier VMs to communicate only with database tier VMs. Applying an ASG to the VMs and referencing it in a network security group rule would be the correct solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpoint for the storage account in an Azure VNet reachable through the VPN.Correct answer▾
Why this is correct
A private endpoint gives the storage account a private IP address inside a VNet. Because the on-premises network already reaches Azure through a site-to-site VPN, on-prem clients can reach that private IP over the encrypted tunnel, provided DNS is also configured to resolve the private name correctly. This satisfies both goals: private connectivity and no public network access to the storage account.
✗A service endpoint on the on-premises network and a storage account firewall exception.Wrong answer — click to see why▾
Why this is wrong here
A service endpoint does not provide a private IP for the storage account; it only allows access from a specific VNet subnet. The storage account would still have a public endpoint, and the firewall exception would allow public traffic from the on-premises VPN gateway's public IP, not a private IP.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to allow access from an on-premises network to an Azure storage account over the public internet, but restrict access to only the on-premises public IP. For example, if the storage account must accept public network traffic but only from a specific on-premises IP range.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking that a service endpoint provides a private IP connection. They might also believe that a firewall exception for the VPN gateway's public IP is sufficient for private IP access.
✗A NAT gateway on the subnet that hosts the storage account.Wrong answer — click to see why▾
Why this is wrong here
A NAT gateway provides outbound internet connectivity for private subnets, but it does not enable private access to a storage account. The storage account must not accept public network traffic, and a NAT gateway does not create a private endpoint or bypass the public endpoint.
★ When this WOULD be the correct answer
A NAT gateway would be correct when you need to provide outbound internet access to resources in a private subnet (e.g., for updates or external API calls) while keeping them isolated from inbound internet traffic. For example, a question requiring outbound-only access for a VM without public IPs.
Why candidates choose this
Candidates may confuse NAT gateway with providing private connectivity, thinking it can route traffic privately to Azure services, or they may misunderstand that NAT is for outbound-only traffic, not inbound private access.
✗An application security group applied to the storage account.Wrong answer — click to see why▾
Why this is wrong here
Application security groups (ASGs) are used to group virtual machines and apply network security rules, not to control access to Azure PaaS services like Blob Storage. They cannot restrict public network traffic to a storage account.
★ When this WOULD be the correct answer
An administrator needs to control network traffic between groups of VMs in a VNet, such as allowing web tier VMs to communicate only with database tier VMs. Applying an ASG to the VMs and referencing it in a network security group rule would be the correct solution.
Why candidates choose this
Candidates may confuse ASGs with service endpoints or private endpoints, thinking they provide a way to secure access to Azure services, or they may assume ASGs can be applied to any Azure resource, not just VMs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A finance web app in AppSubnet must connect to Azure SQL Database over the service's public endpoint. Only AppSubnet should be allowed, and the security team does not want to deploy any private IPs or change DNS. What should you configure?
hard- A.A private endpoint for the SQL server and a private DNS zone linked to AppSubnet.
- ✓ B.Enable the Microsoft.Sql service endpoint on AppSubnet and add a virtual network rule on the SQL server.
- C.Create an NSG rule on AppSubnet to allow outbound TCP 1433 traffic to the SQL server's public IP address.
- D.Publish the AppSubnet public IP address range in the SQL server firewall as an allow list.
Why B: Enabling the Microsoft.Sql service endpoint on AppSubnet allows traffic from that subnet to reach Azure SQL Database's public endpoint without requiring public IP addresses or DNS changes. Adding a virtual network rule on the SQL server restricts access exclusively to that subnet, meeting the security requirement without deploying private IPs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.