Private Endpoint for Azure Storage: Private IP Access from Subnet
A storage account must be reachable only from resources in one Azure subnet, and public network access should not be used. Which configuration best meets this requirement?
Quick Answer
The answer is to create a private endpoint for the storage account in the subnet. This is correct because a private endpoint assigns the storage account a private IP address from the specified Azure subnet, effectively bringing the storage account into the virtual network and ensuring all traffic stays within the Microsoft backbone, never traversing the public internet. On the AZ-104 exam, this question tests your understanding of how private endpoints differ from service endpoints—the key trap is that service endpoints only secure traffic to the public endpoint via the Azure backbone but do not remove public exposure, whereas a private endpoint completely eliminates public network access by giving the resource a private IP. Remember the memory tip: “Private pulls it in, service just secures the path.”
⚠ Common exam trap
Many exam-takers confuse network-level access controls (private endpoints) with data-level access controls (SAS tokens) or management-level controls (locks), mistakenly thinking a SAS token or a lock can restrict network access to a specific subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private endpoint for the storage account in the subnet
A private endpoint assigns the storage account a private IP address from the specified Azure subnet, effectively bringing the storage account into the virtual network. This ensures that all traffic to the storage account stays within the Microsoft Azure backbone network and never traverses the public internet, meeting the requirement to restrict access exclusively to resources in that subnet while disabling public network access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable blob versioning on the storage account
Why it's wrong here
Versioning helps with recovery, but it does not restrict network access to one subnet.
When this WOULD be correct
When the requirement is to protect against accidental deletion or overwrite of blobs by retaining previous versions, such as for data recovery or compliance purposes.
- ✓
Create a private endpoint for the storage account in the subnet
Why this is correct
A private endpoint gives the storage account a private IP address in the subnet, so traffic stays on private network paths.
- ✗
Assign a ReadOnly lock to the storage account
Why it's wrong here
A lock protects against changes or deletion, but it does not control where the storage account can be reached from.
When this WOULD be correct
A question requiring that a storage account's configuration (e.g., firewall rules or network settings) cannot be changed by administrators, but still allows data operations. The ReadOnly lock would prevent accidental modifications while leaving existing network restrictions intact.
- ✗
Enable a shared access signature
Why it's wrong here
A SAS controls authorization, but it does not create private network connectivity or block public access.
When this WOULD be correct
When the requirement is to grant time-limited, delegated access to a specific storage resource (e.g., a blob or file) for an external client without exposing the account key, and network restrictions are not a concern.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a private endpoint for the storage account in the subnetCorrect answer▾
Why this is correct
A private endpoint gives the storage account a private IP address in the subnet, so traffic stays on private network paths.
✗Enable blob versioning on the storage accountWrong answer — click to see why▾
Why this is wrong here
Blob versioning preserves previous versions of blobs but does not restrict network access to a specific subnet; it does not meet the requirement to block public network access.
★ When this WOULD be the correct answer
When the requirement is to protect against accidental deletion or overwrite of blobs by retaining previous versions, such as for data recovery or compliance purposes.
Why candidates choose this
Candidates may confuse versioning with access control, thinking that versioning somehow secures the storage account from unauthorized access.
✗Assign a ReadOnly lock to the storage accountWrong answer — click to see why▾
Why this is wrong here
Assigning a ReadOnly lock prevents modifications to the storage account but does not restrict network access; it does not block public endpoints or enforce private connectivity.
★ When this WOULD be the correct answer
A question requiring that a storage account's configuration (e.g., firewall rules or network settings) cannot be changed by administrators, but still allows data operations. The ReadOnly lock would prevent accidental modifications while leaving existing network restrictions intact.
Why candidates choose this
Candidates may confuse 'lock' with 'block' or think that a lock can restrict access, not realizing locks only affect management operations, not data plane access.
✗Enable a shared access signatureWrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) provides delegated access to storage resources but does not restrict access to a specific subnet or disable public network access; it still relies on the public endpoint.
★ When this WOULD be the correct answer
When the requirement is to grant time-limited, delegated access to a specific storage resource (e.g., a blob or file) for an external client without exposing the account key, and network restrictions are not a concern.
Why candidates choose this
Candidates may think SAS can restrict access to a subnet by specifying an IP range, but SAS does not support subnet-level restrictions and does not disable public network access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A storage account must be reachable only from Azure VMs in a single subnet. Public network access should not be used, and the team wants the storage service to keep using a private IP address inside the virtual network. Which feature should the administrator configure?
medium- A.A service endpoint on the subnet, because it creates a private IP address for the storage account.
- ✓ B.A private endpoint for the storage account in the subnet.
- C.A shared access signature that is limited to the subnet.
- D.Storage account access keys, because they bind access to one subnet automatically.
Why B: A private endpoint assigns the storage account a private IP address from the subnet's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone network. This ensures the storage account is reachable only from VMs in that subnet and blocks all public internet access, meeting both requirements.
Variation 2. A team wants an Azure Storage account to be reachable only from a single Azure virtual network and to use a private IP address inside that network. Which option should the administrator configure?
easy- A.A service endpoint on the subnet.
- ✓ B.A private endpoint for the storage account.
- C.A public IP address with an NSG inbound allow rule.
- D.A VPN gateway connection to the storage account.
Why B: A private endpoint assigns a private IP address from the virtual network to the storage account, making it reachable only from that VNet over the Microsoft backbone network. This meets the requirement of exclusive access and private IP usage, unlike a service endpoint which still exposes the storage account to the public internet via its public endpoint.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.