AZ-104 Implement and Manage Virtual Networking Practice Question
You create a private endpoint for an Azure Storage account. Virtual machines in VNet-App must resolve the storage account name to the private IP address of the endpoint. What should you configure?
⚠ Common exam trap
Watch out — candidates often confuse network-level controls (like UDRs or firewalls) with DNS resolution, assuming they can force traffic to a private IP without configuring name resolution, but private endpoints require explicit DNS configuration to ensure the FQDN resolves to the private IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private DNS zone linked to VNet-App
A private DNS zone linked to VNet-App is required because Azure Private Endpoint uses a private IP address from the virtual network, but the storage account's fully qualified domain name (FQDN) must resolve to that private IP within the VNet. By linking a private DNS zone (e.g., `privatelink.blob.core.windows.net`) to VNet-App and configuring an A record for the endpoint's private IP, VMs can resolve the storage account name to the correct private address. Without this, DNS resolution would fall back to the public IP, defeating the purpose of the private endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A private DNS zone linked to VNet-App
Why this is correct
A private DNS zone (e.g., `privatelink.blob.core.windows.net` for Azure Blob) stores an A record mapping the storage account's FQDN to the private IP assigned to the endpoint. Linking that zone to VNet-App enables VMs to resolve the account name via the private IP, ensuring traffic uses the private endpoint instead of the public endpoint. Without this link, the DNS query falls back to the public endpoint and the private path is not used.
- ✗
A user-defined route on the subnet
Why it's wrong here
User-defined routes (UDRs) operate at the IP layer, specifying the next hop for packets leaving a subnet. They do not perform hostname-to-IP resolution, so they cannot translate the storage account's FQDN to the private endpoint's IP address. While a UDR could steer traffic to a virtual appliance or firewall, DNS resolution remains the responsibility of DNS clients and servers, not routing tables.
- ✗
An additional public IP address
Why it's wrong here
An additional public IP address does nothing to meet the private DNS requirement. A private endpoint is assigned a private IP from the VNet's address space, and clients inside VNet-App must resolve the FQDN to that private IP. Adding a public IP would provide a publicly routable address, but it wouldn't create or alter the internal DNS record needed to map the storage account name to the private endpoint.
When this WOULD be correct
When you need to assign a second public IP to an Azure VM for outbound SNAT or to host multiple SSL websites on the same port, you would configure an additional public IP address on the VM's NIC or load balancer.
- ✗
An Azure Firewall policy
Why it's wrong here
An Azure Firewall policy defines rules that allow or deny traffic based on source, destination, port, and protocol—it does not answer DNS queries or create DNS resource records. Even if a firewall policy is perfectly configured, clients still need a DNS zone that resolves the storage account FQDN to the private IP. A firewall might later filter the connection, but it cannot supply the essential name-to-address mapping for the private endpoint.
When this WOULD be correct
When the question asks how to centrally filter and log traffic from VNet-App to the internet or between spokes, and you need to enforce security rules across multiple subscriptions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private DNS zone linked to VNet-AppCorrect answer▾
Why this is correct
A private DNS zone (e.g., `privatelink.blob.core.windows.net` for Azure Blob) stores an A record mapping the storage account's FQDN to the private IP assigned to the endpoint. Linking that zone to VNet-App enables VMs to resolve the account name via the private IP, ensuring traffic uses the private endpoint instead of the public endpoint. Without this link, the DNS query falls back to the public endpoint and the private path is not used.
✗An additional public IP addressWrong answer — click to see why▾
Why this is wrong here
An additional public IP address is not needed because the private endpoint already provides a private IP for the storage account; the goal is name resolution to that private IP, not public connectivity.
★ When this WOULD be the correct answer
When you need to assign a second public IP to an Azure VM for outbound SNAT or to host multiple SSL websites on the same port, you would configure an additional public IP address on the VM's NIC or load balancer.
Why candidates choose this
Candidates may think that adding a public IP is required for connectivity, confusing the need for private name resolution with public IP assignment.
✗An Azure Firewall policyWrong answer — click to see why▾
Why this is wrong here
An Azure Firewall policy controls inbound/outbound traffic filtering and does not provide DNS resolution or name-to-IP mapping for private endpoints.
★ When this WOULD be the correct answer
When the question asks how to centrally filter and log traffic from VNet-App to the internet or between spokes, and you need to enforce security rules across multiple subscriptions.
Why candidates choose this
Candidates may think Azure Firewall is needed to route traffic to the private endpoint or to enforce DNS policies, confusing network security with name resolution.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
DNS zone
A DNS zone is a distinct part of the global Domain Name System (DNS) namespace that is delegated to a specific administrator or organization for management, containing resource records for a domain.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.