AZ-104 Implement and Manage Storage Practice Question
Exhibit
Storage account network settings: Public network access: Enabled from selected virtual networks Firewall status: No virtual network rules configured AppSubnet settings: Service endpoint for Microsoft.Storage: Not enabled Private endpoint: Not configured Requirement: Restrict access to AppSubnet only, without changing DNS.
Based on the exhibit, the security team wants AppSubnet to access an Azure Storage account through the public endpoint, but only that subnet should be allowed. They do not want a private IP or DNS changes. What should the administrator configure?
⚠ Common exam trap
Test-takers frequently confuse service endpoints (which use public endpoints with subnet-level restriction) with private endpoints (which use private IPs and DNS changes), leading them to choose the private endpoint option despite the explicit 'no private IP or DNS changes' constraint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Microsoft.Storage service endpoint on AppSubnet and add AppSubnet as a network rule on the storage account.
Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to reach the storage account over the Azure backbone network using the public endpoint, without requiring a private IP or DNS changes. Adding AppSubnet as a network rule on the storage account restricts access exclusively to that subnet, fulfilling the security team's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the Microsoft.Storage service endpoint on AppSubnet and add AppSubnet as a network rule on the storage account.
Why this is correct
This keeps the storage account on its public endpoint while restricting access to the selected subnet. Service endpoints identify the traffic as coming from the approved VNet, and the storage firewall rule then allows only AppSubnet. Because no private IP or DNS change is needed, this is the best fit for the requirement.
- ✗
Create a private endpoint for the storage account and disable public access.
Why it's wrong here
Creating a private endpoint installs a private IP address into AppSubnet and requires DNS configuration to resolve the storage account's FQDN to that private IP. It also typically mandates disabling public access, which is the exact opposite of the requirement to keep the storage account on its public endpoint and avoid private IPs and DNS changes. While a private endpoint does provide strong network isolation, it is an over-engineered solution for this scenario, where a service endpoint with a firewall rule achieves the same access control with far less operational overhead.
When this WOULD be correct
This option would be correct if the requirement was to ensure the storage account is not accessible from the public internet at all, and the subnet needs a private, secure connection with no public exposure. For example, a compliance mandate requiring all storage traffic to stay within the Microsoft backbone.
- ✗
Attach a route table that sends storage traffic to the internet.
Why it's wrong here
A route table controls only the next hop for traffic, not the authorization or source identity of the packets. Sending storage traffic to the internet simply follows the default path, so the storage account still sees the subnet's public IP and would not be recognized as approved. Without a service endpoint or a network rule on the storage firewall, the route table does nothing to restrict access to AppSubnet, and it fails to meet the requirement that only AppSubnet be allowed.
When this WOULD be correct
An administrator needs to force all traffic from a subnet to an Azure Storage account to go through a network virtual appliance (NVA) for inspection, and the storage account has a firewall that allows only the NVA's public IP. In that case, a route table with a user-defined route to the NVA would be correct.
- ✗
Grant the subnet a Reader role assignment on the storage account.
Why it's wrong here
A Reader role assignment on the subnet grants control-plane permissions to view the storage account resource, such as its configuration and properties, but it does not govern data-plane traffic. The storage account firewall determines which source networks can reach the service endpoint or public IP, and RBAC roles do not filter or allow network packets. Therefore, assigning Reader to the subnet has no effect on whether AppSubnet can access the storage account's data, so it is completely ineffective for the security team's requirement.
When this WOULD be correct
If the question asked for granting read-only management permissions to a subnet's resources (e.g., allowing a subnet to view storage account configuration in the portal) without any network access control, then assigning the Reader role would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable the Microsoft.Storage service endpoint on AppSubnet and add AppSubnet as a network rule on the storage account.Correct answer▾
Why this is correct
This keeps the storage account on its public endpoint while restricting access to the selected subnet. Service endpoints identify the traffic as coming from the approved VNet, and the storage firewall rule then allows only AppSubnet. Because no private IP or DNS change is needed, this is the best fit for the requirement.
✗Create a private endpoint for the storage account and disable public access.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly states the security team does not want a private IP or DNS changes, and they want to use the public endpoint. A private endpoint assigns a private IP and changes DNS resolution, contradicting these requirements.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to ensure the storage account is not accessible from the public internet at all, and the subnet needs a private, secure connection with no public exposure. For example, a compliance mandate requiring all storage traffic to stay within the Microsoft backbone.
Why candidates choose this
Candidates may think a private endpoint is the most secure option for subnet-only access, overlooking the explicit constraint against private IPs and DNS changes in the question.
✗Attach a route table that sends storage traffic to the internet.Wrong answer — click to see why▾
Why this is wrong here
Attaching a route table that sends storage traffic to the internet does not restrict access to only AppSubnet; it merely forces traffic to the internet, which is the default behavior and does not enforce subnet-level access control.
★ When this WOULD be the correct answer
An administrator needs to force all traffic from a subnet to an Azure Storage account to go through a network virtual appliance (NVA) for inspection, and the storage account has a firewall that allows only the NVA's public IP. In that case, a route table with a user-defined route to the NVA would be correct.
Why candidates choose this
Candidates may think that routing storage traffic to the internet is necessary because the storage account uses a public endpoint, but they overlook that the question's goal is to restrict access to a specific subnet, not to control the path of traffic.
✗Grant the subnet a Reader role assignment on the storage account.Wrong answer — click to see why▾
Why this is wrong here
A Reader role assignment grants read-only access to the storage account resource itself, not network access to the data plane. It does not control which subnets can reach the storage account's public endpoint.
★ When this WOULD be the correct answer
If the question asked for granting read-only management permissions to a subnet's resources (e.g., allowing a subnet to view storage account configuration in the portal) without any network access control, then assigning the Reader role would be correct.
Why candidates choose this
Candidates may confuse Azure RBAC roles with network access controls, thinking that a role assignment can restrict which subnet can access the storage account's data endpoint.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.