AZ-104 Implement and Manage Virtual Networking Practice Question
You create a private endpoint for an Azure Storage account. Virtual machines in VNet-Prod must resolve the storage account name to the private IP address of that endpoint. Which Azure feature should you configure?
⚠ Common exam trap
Many candidates confuse network-level traffic control (UDRs or firewalls) with DNS resolution, assuming that routing or filtering traffic is sufficient to force private connectivity, when in fact DNS must be explicitly configured to resolve to the private IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private DNS zone linked to VNet-Prod
A private endpoint uses a private IP address from the VNet, but DNS resolution must be explicitly configured to map the storage account's FQDN to that private IP. By creating a private DNS zone (privatelink.blob.core.windows.net) linked to VNet-Prod, Azure automatically creates an A record for the private endpoint IP, enabling VMs to resolve the storage account name to the private IP instead of the public IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A private DNS zone linked to VNet-Prod
Why this is correct
A private DNS zone linked to VNet-Prod is correct because the storage account FQDN (e.g., myaccount.blob.core.windows.net) must resolve to the private endpoint's private IP address for clients inside the virtual network. The zone (privatelink.blob.core.windows.net) is linked to VNet-Prod and contains an A record mapping the storage endpoint to the private IP, allowing traffic to stay within the Microsoft backbone. Without this zone, clients would still use the public IP, defeating the isolation benefits of the private endpoint.
- ✗
A user-defined route
Why it's wrong here
A user-defined route (UDR) controls the next hop for traffic leaving a subnet, such as sending packets to a network virtual appliance or to the internet, but it has no ability to map hostnames to IP addresses. Because a private endpoint fails when the storage account's FQDN resolves to a public IP, the missing component is a DNS record, not a routing table entry. Even if a UDR forces traffic through a firewall, name resolution must still occur first, so the UDR does not fix the resolution gap.
When this WOULD be correct
A user-defined route would be correct in a scenario where you need to force traffic from a subnet to go through a network virtual appliance (e.g., firewall) for inspection, such as when you want to route all outbound traffic from VNet-Prod through an Azure Firewall.
- ✗
An Azure Firewall policy
Why it's wrong here
An Azure Firewall policy defines collections of network and application rules that filter or allow traffic based on IP addresses, ports, and FQDNs, but it does not perform authoritative name resolution for Azure PaaS endpoints. The policy can be paired with the firewall's DNS proxy to forward queries, but it cannot itself answer a query for the storage account's private endpoint; it lacks the zone and A record. Therefore, a firewall policy is not a substitute for a private DNS zone linked to VNet-Prod.
When this WOULD be correct
When the question asks how to filter traffic from VNet-Prod to the internet or to on-premises networks, and you need to enforce security rules and logging, an Azure Firewall policy would be the correct answer.
- ✗
A Recovery Services vault
Why it's wrong here
A Recovery Services vault does not participate in DNS resolution because it is strictly used for backup, Site Recovery, and restore operations. It stores recovery points and backup policies, not DNS records or endpoint mappings. Linking a Recovery Services vault to VNet-Prod could enable private access to backup traffic, but it can never satisfy the storage account's FQDN resolution requirement for a private endpoint, so this option is irrelevant to the issue.
When this WOULD be correct
A Recovery Services vault would be the correct answer in a question about configuring backup for Azure VMs or on-premises machines, or setting up replication (Azure Site Recovery) between regions. For example: 'You need to back up Azure virtual machines to a central location. Which Azure resource should you create?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private DNS zone linked to VNet-ProdCorrect answer▾
Why this is correct
A private DNS zone linked to VNet-Prod is correct because the storage account FQDN (e.g., myaccount.blob.core.windows.net) must resolve to the private endpoint's private IP address for clients inside the virtual network. The zone (privatelink.blob.core.windows.net) is linked to VNet-Prod and contains an A record mapping the storage endpoint to the private IP, allowing traffic to stay within the Microsoft backbone. Without this zone, clients would still use the public IP, defeating the isolation benefits of the private endpoint.
✗A user-defined routeWrong answer — click to see why▾
Why this is wrong here
A user-defined route (UDR) controls network traffic flow by overriding default routing, but it does not provide DNS resolution. The question requires resolving the storage account name to a private IP, which is a DNS function, not a routing one.
★ When this WOULD be the correct answer
A user-defined route would be correct in a scenario where you need to force traffic from a subnet to go through a network virtual appliance (e.g., firewall) for inspection, such as when you want to route all outbound traffic from VNet-Prod through an Azure Firewall.
Why candidates choose this
Candidates may confuse private endpoint connectivity with routing, thinking that a UDR is needed to direct traffic to the private endpoint, but DNS resolution is the actual requirement here.
✗An Azure Firewall policyWrong answer — click to see why▾
Why this is wrong here
An Azure Firewall policy controls outbound/inbound traffic filtering and does not manage DNS resolution or private endpoint name resolution.
★ When this WOULD be the correct answer
When the question asks how to filter traffic from VNet-Prod to the internet or to on-premises networks, and you need to enforce security rules and logging, an Azure Firewall policy would be the correct answer.
Why candidates choose this
Candidates may confuse network security features, thinking a firewall policy can also handle DNS resolution or private endpoint connectivity, when its role is strictly traffic filtering.
✗A Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for backup and disaster recovery (Azure Backup, Site Recovery), not for DNS resolution or private endpoint connectivity. It does not provide DNS resolution for storage account names to private IP addresses.
★ When this WOULD be the correct answer
A Recovery Services vault would be the correct answer in a question about configuring backup for Azure VMs or on-premises machines, or setting up replication (Azure Site Recovery) between regions. For example: 'You need to back up Azure virtual machines to a central location. Which Azure resource should you create?'
Why candidates choose this
Candidates may confuse Recovery Services vault with Azure Private Link or DNS features, thinking it can manage network connectivity or name resolution, due to its role in protecting resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Private IP address
A private IP address is a non-internet-routable address used within a local network to identify devices and allow them to communicate with each other without direct exposure to the public internet.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.