AZ-104 Implement and Manage Virtual Networking Practice Question
You create a private endpoint for an Azure Storage account and disable public network access on the account. A VM in a peered VNet cannot reach the storage account by name. The private endpoint resides in VNet-App. What is the most likely missing configuration?
⚠ Common exam trap
Many exam-takers assume VNet peering automatically extends DNS resolution for private endpoints, but Azure requires explicit private DNS zone links to each VNet that needs to resolve the private endpoint name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private DNS zone linked so the relevant VNet can resolve the storage account to the private endpoint IP
When you create a private endpoint for an Azure Storage account and disable public network access, the storage account's public DNS name must resolve to the private endpoint's private IP address within the VNet. This requires a private DNS zone (privatelink.blob.core.windows.net) linked to the VNet where the VM resides. Without that DNS zone link, the VM in the peered VNet will resolve the storage account name to the public IP, which is unreachable because public access is disabled, causing the connection failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A private DNS zone linked so the relevant VNet can resolve the storage account to the private endpoint IP
Why this is correct
A private endpoint allocates a private IP from the VNet subnet, but the storage account's public FQDN still resolves to its public IP unless you override resolution. Linking a private DNS zone (e.g., privatelink.blob.core.windows.net) to the VNet and creating an A record for the endpoint makes the storage account name resolve to the private IP. This DNS integration is the essential companion to the private endpoint, and without it clients in the VNet would keep bypassing the endpoint.
- ✗
An NSG rule allowing outbound DNS to 8.8.8.8
Why it's wrong here
Configuring an NSG rule that permits outbound DNS to 8.8.8.8 targets a public resolver, which has no record for the storage account's private endpoint and would return the public IP address. Private endpoint name resolution requires Azure DNS or a DNS server that forwards to Azure's internal resolver (168.63.129.16) and has access to the private DNS zone. Allowing public DNS simply fails to map the FQDN to the endpoint's private IP, so it cannot correct the connectivity issue.
When this WOULD be correct
This option would be correct in a scenario where a VM in a VNet cannot reach an Azure service (e.g., storage account) via its public endpoint because an NSG on the VM subnet blocks outbound traffic to the internet, and the service does not use private endpoints. Adding an NSG rule to allow outbound DNS to 8.8.8.8 would enable the VM to resolve the service's public name.
- ✗
A Recovery Services vault in the peered VNet
Why it's wrong here
Recovery Services vaults are backup and disaster-recovery constructs; they do not participate in VNet name resolution or private endpoint routing. Placing one in a peered VNet neither creates a private IP mapping for the storage account nor links a DNS zone to your client's VNet. The storage account's public DNS record remains untouched, so application traffic would still leave the VNet over the public endpoint instead of using the private endpoint.
When this WOULD be correct
If the question asked about why a VM cannot back up data to a Recovery Services vault after configuring a private endpoint, or if the vault's network settings block traffic from a peered VNet, then a missing vault configuration (like allowing trusted Microsoft services) could be the issue.
- ✗
A public IP address on the private endpoint NIC
Why it's wrong here
A private endpoint NIC is designed to carry only a private IP from the subnet in which it is provisioned; attaching a public IP would directly violate this isolation model and negate the security purpose of the endpoint. Azure does not support assigning a public IP to a private endpoint's network interface, as the whole feature exists to ensure traffic stays within the private address space. Any attempt to make the endpoint publicly reachable would break the connectivity model rather than fix DNS resolution.
When this WOULD be correct
This option would be correct in a scenario where a private endpoint is used for a service that requires public IP-based access (e.g., Azure PaaS service with a public endpoint) and the question asks for a configuration to allow outbound traffic from the private endpoint to the internet via a public IP.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private DNS zone linked so the relevant VNet can resolve the storage account to the private endpoint IPCorrect answer▾
Why this is correct
A private endpoint allocates a private IP from the VNet subnet, but the storage account's public FQDN still resolves to its public IP unless you override resolution. Linking a private DNS zone (e.g., privatelink.blob.core.windows.net) to the VNet and creating an A record for the endpoint makes the storage account name resolve to the private IP. This DNS integration is the essential companion to the private endpoint, and without it clients in the VNet would keep bypassing the endpoint.
✗An NSG rule allowing outbound DNS to 8.8.8.8Wrong answer — click to see why▾
Why this is wrong here
The issue is DNS resolution, not outbound internet DNS. The VM cannot resolve the storage account name because the private endpoint's private DNS zone is not linked to the peered VNet. An NSG rule allowing outbound DNS to 8.8.8.8 would not help because the VM uses Azure DNS (168.63.129.16) for name resolution, and the private endpoint requires a custom DNS zone.
★ When this WOULD be the correct answer
This option would be correct in a scenario where a VM in a VNet cannot reach an Azure service (e.g., storage account) via its public endpoint because an NSG on the VM subnet blocks outbound traffic to the internet, and the service does not use private endpoints. Adding an NSG rule to allow outbound DNS to 8.8.8.8 would enable the VM to resolve the service's public name.
Why candidates choose this
Candidates may think that DNS resolution requires internet access, so they assume an NSG rule allowing outbound DNS to a public resolver like 8.8.8.8 would fix the issue. They overlook that Azure VMs use Azure DNS by default and that private endpoints rely on custom DNS zones, not public DNS.
✗A Recovery Services vault in the peered VNetWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for backup and disaster recovery, not for network connectivity or DNS resolution. It does not enable a VM in a peered VNet to resolve a storage account's private endpoint.
★ When this WOULD be the correct answer
If the question asked about why a VM cannot back up data to a Recovery Services vault after configuring a private endpoint, or if the vault's network settings block traffic from a peered VNet, then a missing vault configuration (like allowing trusted Microsoft services) could be the issue.
Why candidates choose this
Candidates may confuse Recovery Services vaults with Azure Private Link or DNS zones, thinking that vaults provide some form of network connectivity or name resolution for private endpoints.
✗A public IP address on the private endpoint NICWrong answer — click to see why▾
Why this is wrong here
A private endpoint NIC does not require a public IP address; it uses a private IP from the VNet. Adding a public IP would not resolve the name resolution issue, as the problem is DNS resolution, not public connectivity.
★ When this WOULD be the correct answer
This option would be correct in a scenario where a private endpoint is used for a service that requires public IP-based access (e.g., Azure PaaS service with a public endpoint) and the question asks for a configuration to allow outbound traffic from the private endpoint to the internet via a public IP.
Why candidates choose this
Candidates may mistakenly think that a private endpoint needs a public IP for name resolution or internet access, confusing the private endpoint's role with that of a standard VM or load balancer.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.