The answer is to configure a private endpoint for the storage account within the target subnet. A private endpoint assigns a private IP address from that subnet directly to the storage account, effectively bringing the Azure service into the virtual network. This ensures all traffic to the storage account uses the private IP and never traverses the public endpoint, meeting both the reachability and private IP requirements. On the AZ-104 exam, this scenario tests your understanding of how private endpoints differ from service endpoints—a common trap is confusing the two, but remember that only a private endpoint provides a private IP and eliminates public internet exposure. Service endpoints keep the public endpoint but restrict access via a route, so they do not satisfy the private IP requirement. A quick memory tip: think “private IP = private endpoint” to lock in the distinction.
AZ-104 Implement and Manage Virtual Networking Practice Question
This AZ-104 practice question tests your understanding of implement and manage virtual networking. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: private endpoints assign a private IP from your VNet to an Azure service.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A storage account must be reachable only from resources in one Azure subnet, and traffic must use a private IP rather than the public endpoint. Which configuration should the administrator implement?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint in the subnet
A private endpoint assigns a private IP address from the subnet to the storage account, making it accessible only via that private IP within the virtual network. This ensures traffic never traverses the public endpoint, meeting both the reachability and private IP requirements.
Key principle: Private endpoints assign a private IP from your VNet to an Azure service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
A service endpoint on the subnet
Why it's wrong here
Service endpoints still use the storage account's public endpoint, so the traffic is not private IP based.
✓
A private endpoint in the subnet
Why this is correct
A private endpoint gives the storage service a private IP in the subnet and removes reliance on the public endpoint.
Related concept
Private endpoints assign a private IP from your VNet to an Azure service.
✗
A shared access signature scoped to the subnet
Why it's wrong here
A SAS controls authorization only; it cannot restrict access to a subnet by itself.
✗
Allow trusted Microsoft services on the storage firewall
Why it's wrong here
This opens access to many Microsoft services and does not limit access to one specific subnet.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing service endpoints with private endpoints: both restrict access to a subnet, but only a private endpoint provides a private IP and fully removes traffic from the public endpoint.
Detailed technical explanation
How to think about this question
A private endpoint uses Azure Private Link, which creates a network interface (NIC) in the subnet with a private IP from the subnet's range. DNS resolution for the storage account's FQDN (e.g., mystorageaccount.blob.core.windows.net) is overridden to resolve to that private IP via a private DNS zone (privatelink.blob.core.windows.net). This ensures traffic stays within the Microsoft backbone and never leaves the virtual network, even over VPN or ExpressRoute.
KKey Concepts to Remember
Private endpoints assign a private IP from your VNet to an Azure service.
Traffic to a private endpoint bypasses the public internet entirely.
Private endpoints integrate Azure services directly into your virtual network.
DNS resolution for the service FQDN is updated to the private IP.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Private endpoints assign a private IP from your VNet to an Azure service.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-104 question in full detail.
Review private endpoints assign a private IP from your VNet to an Azure service., then practise related AZ-104 questions on the same topic to reinforce the concept.
Implement and Manage Virtual Networking — This question tests Implement and Manage Virtual Networking — Private endpoints assign a private IP from your VNet to an Azure service..
What is the correct answer to this question?
The correct answer is: A private endpoint in the subnet — A private endpoint assigns a private IP address from the subnet to the storage account, making it accessible only via that private IP within the virtual network. This ensures traffic never traverses the public endpoint, meeting both the reachability and private IP requirements.
What should I do if I get this AZ-104 question wrong?
Review private endpoints assign a private IP from your VNet to an Azure service., then practise related AZ-104 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Private endpoints assign a private IP from your VNet to an Azure service.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A storage account must be reachable only from a single Azure VNet. The team wants the storage account to have a private IP in that VNet and wants to disable public network access. Which solution should the administrator implement?
medium
A.Configure a service endpoint on the subnet and keep public network access enabled.
✓ B.Create a private endpoint for the storage account and disable public network access.
C.Assign a shared access signature and rely on IP-based firewall rules.
D.Use a route table to force traffic to the storage account over the virtual network gateway.
Why B: A private endpoint assigns the storage account a private IP from the VNet, making it accessible only within that VNet over a private connection. Disabling public network access ensures no traffic can reach the storage account from the internet, meeting both requirements. This is the only option that provides a private IP and blocks all public access.
Variation 2. A storage account must be reachable only from one Azure virtual network. The team wants the storage service to have a private IP in that VNet, public network access disabled, and name resolution to work without using the public endpoint. What should the administrator configure?
medium
A.A service endpoint on the subnet and a storage firewall rule
✓ B.A private endpoint and a private DNS zone linked to the VNet
C.A public IP address and IP-based firewall exceptions
D.A shared access signature and blob container ACLs
Why B: A private endpoint assigns the storage account a private IP from the VNet's address space, making it reachable only within that VNet. Disabling public network access ensures no traffic can reach the storage account via its public endpoint. A private DNS zone linked to the VNet enables name resolution to resolve the storage account's FQDN to the private IP without using the public endpoint.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.