Implement and Manage Virtual Networking →mediumMultiple ChoiceObjective-mapped

AZ-104 Implement and Manage Virtual Networking Practice Question

Exhibit

Storage account access requirements:
- Access should be limited to subnet AppSubnet
- The storage account should keep using its public endpoint
- No private endpoint should be created
- No private DNS zone should be managed
- The workload is allowed to use Azure platform integration features

Based on the exhibit, which feature should you enable so the subnet can access the storage account without creating a private IP address in the VNet?

⚠ Common exam trap

Many candidates confuse Private Endpoint (which creates a private IP) with Service Endpoint (which does not), often assuming any 'private' access requires a private IP, but Service Endpoint provides private access over the Microsoft backbone without allocating an IP in the VNet.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Service endpoint

Service endpoints allow a subnet to securely and privately connect to Azure PaaS services (like Storage Accounts) over the Azure backbone network without requiring a private IP address in the VNet. They extend the VNet identity to the service, enabling access via the service's public endpoint while restricting traffic to the subnet. This matches the requirement exactly: no private IP is created in the VNet, and the storage account is accessed directly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Private endpoint
Why it's wrong here
A private endpoint creates a network interface with a private IP address from the VNet and injects the storage account into the VNet, requiring a change in how traffic reaches the service. The requirement explicitly states not to use a private IP address, so this option violates the constraint even though it does provide secure subnet-level connectivity. Private endpoints are for scenarios where you want the service to appear as a native VNet resource, which is not allowed here.
When this WOULD be correct
A question that asks: 'Which feature should you use to access a storage account securely over the Microsoft backbone network from a VNet, ensuring traffic never traverses the public internet, and you are allowed to create a private IP address in the VNet?'
✓
Service endpoint
Why this is correct
A service endpoint extends the virtual network identity to the storage account over the Microsoft.Storage service, so the storage firewall can allow access from a specific subnet. You enable this on the subnet in the VNet and configure the storage account firewall to allow that subnet, which grants private subnet-level access without assigning a private IP. This exactly satisfies the requirement of restricting traffic by subnet while keeping the storage account on its public endpoint.
✗
VPN Gateway
Why it's wrong here
A VPN gateway establishes encrypted IPsec tunnels between on-premises networks and the VNet, or between VNets, but it does not integrate with the storage account's firewall to authorize a specific subnet. Even if a VPN gateway is present, the storage account firewall still evaluates source IP or service endpoint, not the VPN tunnel's identity. Therefore, a VPN gateway alone cannot fulfill the requirement of granting subnet-level access to the storage service.
When this WOULD be correct
A VPN Gateway would be correct in a scenario requiring secure, site-to-site connectivity between an on-premises network and an Azure VNet, such as extending a corporate datacenter to Azure for hybrid workloads.
✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed network security service that filters traffic between subnets and external networks, but it does not add subnet membership to the storage account's network rules. To use Azure Firewall with a storage account you would typically force-tunnel traffic to the firewall via a route and then rely on the firewall's public IP as the source, but that does not provide VNet/subnet identity for the storage firewall. The requirement asks to enable a feature that directly authorizes the subnet, which Azure Firewall cannot do.
When this WOULD be correct
Azure Firewall would be correct in a scenario where you need to centrally control outbound traffic from a VNet to the internet or to Azure services, with logging and threat intelligence. For example, 'You need to filter and log all outbound traffic from a VNet to the internet, ensuring only allowed destinations are reachable.'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓Service endpointCorrect answer▾

Why this is correct

A service endpoint extends the virtual network identity to the storage account over the Microsoft.Storage service, so the storage firewall can allow access from a specific subnet. You enable this on the subnet in the VNet and configure the storage account firewall to allow that subnet, which grants private subnet-level access without assigning a private IP. This exactly satisfies the requirement of restricting traffic by subnet while keeping the storage account on its public endpoint.

✗Private endpointWrong answer — click to see why▾

Why this is wrong here

Private endpoint creates a private IP address in the VNet for the storage account, which contradicts the requirement to avoid creating a private IP address. Service endpoints do not assign a private IP; they extend the VNet identity to the PaaS service.

★ When this WOULD be the correct answer

A question that asks: 'Which feature should you use to access a storage account securely over the Microsoft backbone network from a VNet, ensuring traffic never traverses the public internet, and you are allowed to create a private IP address in the VNet?'

Why candidates choose this

Candidates may confuse private endpoint with service endpoint because both provide secure access to PaaS services from a VNet, but they differ in IP assignment and network isolation.

✗VPN GatewayWrong answer — click to see why▾

Why this is wrong here

A VPN Gateway creates an encrypted tunnel between on-premises and Azure, not a direct connection from a subnet to a storage account without a private IP. It does not enable subnet-to-PaaS service access without private endpoints.

★ When this WOULD be the correct answer

A VPN Gateway would be correct in a scenario requiring secure, site-to-site connectivity between an on-premises network and an Azure VNet, such as extending a corporate datacenter to Azure for hybrid workloads.

Why candidates choose this

Candidates may confuse VPN Gateway with a method to access Azure services privately, not realizing it's for hybrid connectivity rather than PaaS service endpoints.

✗Azure FirewallWrong answer — click to see why▾

Why this is wrong here

Azure Firewall is a managed network security service that filters traffic, but it does not enable private access to Azure PaaS services without a private IP address. The question requires a feature that allows subnet access to a storage account without creating a private IP in the VNet, which is achieved by service endpoints, not Azure Firewall.

★ When this WOULD be the correct answer

Azure Firewall would be correct in a scenario where you need to centrally control outbound traffic from a VNet to the internet or to Azure services, with logging and threat intelligence. For example, 'You need to filter and log all outbound traffic from a VNet to the internet, ensuring only allowed destinations are reachable.'

Why candidates choose this

Candidates may confuse Azure Firewall's ability to control traffic to Azure services (via service tags) with the direct connectivity provided by service endpoints, or they might think a firewall is required for secure access to storage accounts.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Go deeper

AZ-104 Implement and Manage Virtual Networking Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question