AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Storage account: stprod01 Networking: - Public network access: Disabled - Private endpoint connections: None - Allowed virtual networks: None VNet: AppVNet Subnet: AppSubnet 10.50.1.0/24 Requirement: "Azure VMs in AppSubnet must reach the storage account without using the public endpoint."
Based on the exhibit, what should the administrator create so VMs in AppSubnet can access the storage account over a private IP address?
⚠ Common exam trap
Many exam-takers confuse service endpoints (which still use the public endpoint but with source subnet restriction) with private endpoints (which provide a true private IP address), leading candidates to incorrectly choose A when the question explicitly requires access over a private IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint for the storage account in AppSubnet.
A private endpoint assigns a private IP address from AppSubnet to the storage account, enabling VMs in that subnet to access the storage account over a private IP within the VNet. This eliminates exposure to the public internet and uses Azure Private Link for secure, direct connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service endpoint for Microsoft.Storage on AppSubnet.
Why it's wrong here
A service endpoint for Microsoft.Storage enables AppSubnet traffic to reach the storage account over the Azure backbone, but it routes to the storage account's public endpoint, not to a private IP inside the VNet. The requirement explicitly calls for a private IP address for the storage account in AppSubnet, which a service endpoint cannot deliver. Additionally, service endpoints rely on the storage firewall allow-listing the subnet and do not remove the need for public DNS resolution to a public IP.
When this WOULD be correct
A service endpoint would be correct if the question asked for secure access from a subnet to a storage account using Azure backbone network without requiring a private IP, or if the goal was to restrict storage account access to a specific subnet while still using the public endpoint.
- ✓
A private endpoint for the storage account in AppSubnet.
Why this is correct
A private endpoint assigns the storage account a private IP address in the VNet, which is exactly what the exhibit requires. With public access disabled, the private endpoint is the correct way for the VMs to reach the storage service privately from AppSubnet.
- ✗
A site-to-site VPN gateway between AppVNet and the storage account.
Why it's wrong here
A site-to-site VPN gateway creates an encrypted IPsec tunnel between two network environments, such as an on-premises network and an Azure VNet, but it cannot terminate directly on a PaaS service like a storage account. The storage account has no VPN endpoint or virtual network gateway to accept a site-to-site tunnel. Even if a VPN gateway were added to AppVNet, it would not assign a private IP to the storage account, so it fails to satisfy the requirement.
When this WOULD be correct
A site-to-site VPN gateway would be correct if the question asked how to connect an on-premises network to AppVNet for hybrid connectivity, or how to enable on-premises VMs to access the storage account over a private IP.
- ✗
An application security group for the storage account and subnet.
Why it's wrong here
An application security group (ASG) is a logical grouping of VM network interfaces used to simplify NSG rule application, not a connectivity construct for Azure PaaS services. A storage account cannot be added to an ASG, and ASGs do not provide any path for outbound traffic from VMs to storage. Creating an ASG would only affect filtering rules between VM NICs in AppSubnet, leaving storage access unchanged.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpoint for the storage account in AppSubnet.Correct answer▾
Why this is correct
A private endpoint assigns the storage account a private IP address in the VNet, which is exactly what the exhibit requires. With public access disabled, the private endpoint is the correct way for the VMs to reach the storage service privately from AppSubnet.
✗A service endpoint for Microsoft.Storage on AppSubnet.Wrong answer — click to see why▾
Why this is wrong here
A service endpoint provides access over the Azure backbone network but still uses a public IP address for the storage account, not a private IP address within the virtual network. The question specifically requires private IP access, which only a private endpoint can provide.
★ When this WOULD be the correct answer
A service endpoint would be correct if the question asked for secure access from a subnet to a storage account using Azure backbone network without requiring a private IP, or if the goal was to restrict storage account access to a specific subnet while still using the public endpoint.
Why candidates choose this
Candidates often confuse service endpoints with private endpoints, thinking both provide private IP connectivity, but service endpoints only route traffic over the Azure backbone while keeping the public endpoint.
✗A site-to-site VPN gateway between AppVNet and the storage account.Wrong answer — click to see why▾
Why this is wrong here
A site-to-site VPN gateway connects on-premises networks to Azure VNets, not to a specific storage account, and does not provide private IP access from a subnet to a storage account.
★ When this WOULD be the correct answer
A site-to-site VPN gateway would be correct if the question asked how to connect an on-premises network to AppVNet for hybrid connectivity, or how to enable on-premises VMs to access the storage account over a private IP.
Why candidates choose this
Candidates may confuse site-to-site VPN with private connectivity, thinking a VPN tunnel provides private IP access, but it actually extends the network rather than creating a private endpoint within the subnet.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Private IP address
A private IP address is a non-internet-routable address used within a local network to identify devices and allow them to communicate with each other without direct exposure to the public internet.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.