AZ-104 Implement and Manage Storage Practice Question
A team wants to restrict a storage account so only one Azure subnet can reach it. They do not need a private IP address, and they are fine with the storage account still using its public endpoint. Which configuration should the administrator use?
⚠ Common exam trap
Many exam-takers confuse private endpoints (which require a private IP and can disable the public endpoint) with service endpoints (which keep the public endpoint but restrict access by subnet), leading them to incorrectly choose Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.
A service endpoint extends the virtual network identity to the storage account over the public endpoint, allowing the administrator to restrict access to only traffic originating from that specific subnet via the storage account firewall. This meets the requirement of using the public endpoint while limiting access to a single Azure subnet without needing a private IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a private endpoint and disable public network access.
Why it's wrong here
A private endpoint would give the service a private IP, which is more restrictive than the requirement and changes how DNS works. The team explicitly does not need a private IP. This option solves a different problem than the one described.
When this WOULD be correct
When the requirement is to ensure the storage account is not accessible from the public internet at all, and a private IP address is acceptable, such as for a highly secure application that must avoid any exposure via public endpoints.
- ✓
Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.
Why this is correct
A service endpoint extends the subnet identity to the storage service while traffic still reaches the public endpoint. Adding the subnet to the storage firewall then limits access to that subnet. This matches the requirement exactly because the team does not need a private IP, only subnet-restricted access.
- ✗
Generate a user delegation SAS token and distribute it only to the subnet.
Why it's wrong here
A SAS token controls access at the application level, not by subnet. It cannot enforce network-based restriction to a specific Azure subnet. This solution would not meet the requirement for network control through the storage firewall.
When this WOULD be correct
An administrator needs to grant time-limited, delegated access to specific storage resources (e.g., a container or blob) for a client application without sharing the storage account key, and network restrictions are not a concern.
- ✗
Change the redundancy setting to ZRS and enable soft delete.
Why it's wrong here
Redundancy and deletion protection do not control which subnet can connect to the account. These settings improve durability or recovery, but they do not restrict network access. The request is specifically about network filtering, not resiliency features.
When this WOULD be correct
A question requiring high availability for storage data across availability zones and protection against accidental deletion would make ZRS and soft delete correct, e.g., 'You need to ensure storage data survives a zone failure and can recover from accidental deletion.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.Correct answer▾
Why this is correct
A service endpoint extends the subnet identity to the storage service while traffic still reaches the public endpoint. Adding the subnet to the storage firewall then limits access to that subnet. This matches the requirement exactly because the team does not need a private IP, only subnet-restricted access.
✗Create a private endpoint and disable public network access.Wrong answer — click to see why▾
Why this is wrong here
The team does not need a private IP address and is fine with the public endpoint, but a private endpoint disables public network access by default, which contradicts the requirement.
★ When this WOULD be the correct answer
When the requirement is to ensure the storage account is not accessible from the public internet at all, and a private IP address is acceptable, such as for a highly secure application that must avoid any exposure via public endpoints.
Why candidates choose this
Candidates may confuse private endpoints with service endpoints, thinking both restrict access to a subnet, but private endpoints also change the network path and disable public access, which is not needed here.
✗Generate a user delegation SAS token and distribute it only to the subnet.Wrong answer — click to see why▾
Why this is wrong here
A user delegation SAS token grants access to specific resources but does not restrict access to a single subnet; it can be used from any IP address or network that has the token.
★ When this WOULD be the correct answer
An administrator needs to grant time-limited, delegated access to specific storage resources (e.g., a container or blob) for a client application without sharing the storage account key, and network restrictions are not a concern.
Why candidates choose this
Candidates may think that distributing the SAS token only to the subnet's resources effectively limits access, but SAS tokens do not enforce network-level restrictions and can be used from anywhere.
✗Change the redundancy setting to ZRS and enable soft delete.Wrong answer — click to see why▾
Why this is wrong here
Changing redundancy to ZRS and enabling soft delete does not restrict network access to a subnet; ZRS provides data durability across zones, and soft delete protects against accidental deletion, neither of which controls network-level access.
★ When this WOULD be the correct answer
A question requiring high availability for storage data across availability zones and protection against accidental deletion would make ZRS and soft delete correct, e.g., 'You need to ensure storage data survives a zone failure and can recover from accidental deletion.'
Why candidates choose this
Candidates may confuse data protection features (redundancy, soft delete) with network security controls, or think that changing redundancy somehow isolates the storage account to a subnet.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.