AZ-104 Deploy and Manage Azure Compute Practice Question
Your company hosts an internal web app in Azure App Service. Access must be limited to users connecting from the corporate virtual network over private IP addresses only. What should you configure?
⚠ Common exam trap
Many candidates confuse access restrictions (which filter by public IP) with private endpoint (which eliminates public exposure entirely), mistakenly thinking IP-based restrictions can enforce private-only access when they cannot prevent internet routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A private endpoint for the web app.
A private endpoint assigns a private IP address from your virtual network to the web app, making it accessible only over the corporate network via private IPs. This ensures traffic never traverses the public internet, meeting the requirement for private IP-only access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An App Service Environment only.
Why it's wrong here
An App Service Environment (ASE) alone does not solve the privacy requirement. ASE is a fully isolated and dedicated hosting environment that you can place inside a VNet, but it is a costly infrastructure change and still exposes a public endpoint by default unless you specifically configure an internal load balancer. The question asks for a way to restrict access to the existing web app, not for a complete hosting environment overhaul.
When this WOULD be correct
If the question required complete network isolation, dedicated compute resources, or the ability to run in a single-tenant environment (e.g., for compliance or high-scale needs), then an App Service Environment would be the correct answer.
- ✗
Access restrictions based on public IP ranges only.
Why it's wrong here
Access restrictions based on public IP ranges are insufficient because they only filter traffic at the application layer while the app continues to have a publicly addressable endpoint on the internet. Requests still travel over public networks, just from allowed IP ranges, and they rely on header validation rather than true network isolation. This approach does not remove the public exposure and does not provide the direct, private, vNet-based connectivity that a private endpoint offers.
When this WOULD be correct
This option would be correct if the question required restricting access to the web app based on a specific set of public IP addresses (e.g., from a branch office with a static public IP) and did not involve private IP addresses or virtual network integration.
- ✓
A private endpoint for the web app.
Why this is correct
A private endpoint for the web app is the correct solution because it assigns the App Service a private IP address from your virtual network, enabling direct and secure access without traversing the public internet. When configured with the 'Deny public access' option, the public endpoint is removed entirely, leaving only the private route from your VNet. This gives you the precise control over connectivity you need while keeping the existing App Service plan.
- ✗
A public load balancer in front of the web app.
Why it's wrong here
A public load balancer in front of the web app is not only ineffective but counterproductive for this goal. It introduces a public-facing IP address and only distributes traffic, making the service even more accessible from the internet rather than less. Furthermore, App Service with a public load balancer is not a supported configuration for private access, because the load balancer would not terminate the public exposure and cannot provide a private IP from within your VNet.
When this WOULD be correct
If the question required distributing incoming internet traffic across multiple App Service instances for high availability and scalability, a public load balancer would be the correct choice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A private endpoint for the web app.Correct answer▾
Why this is correct
A private endpoint for the web app is the correct solution because it assigns the App Service a private IP address from your virtual network, enabling direct and secure access without traversing the public internet. When configured with the 'Deny public access' option, the public endpoint is removed entirely, leaving only the private route from your VNet. This gives you the precise control over connectivity you need while keeping the existing App Service plan.
✗An App Service Environment only.Wrong answer — click to see why▾
Why this is wrong here
An App Service Environment (ASE) is not required to limit access to private IPs; a private endpoint on a standard App Service can achieve this without the cost and complexity of an ASE.
★ When this WOULD be the correct answer
If the question required complete network isolation, dedicated compute resources, or the ability to run in a single-tenant environment (e.g., for compliance or high-scale needs), then an App Service Environment would be the correct answer.
Why candidates choose this
Candidates may think that only an ASE can provide private network access, not realizing that a private endpoint on a regular App Service also restricts traffic to the virtual network.
✗Access restrictions based on public IP ranges only.Wrong answer — click to see why▾
Why this is wrong here
Access restrictions based on public IP ranges only allow filtering by public IP addresses, not private IP addresses from a virtual network. The question requires limiting access to users connecting from the corporate virtual network over private IP addresses, which cannot be achieved with public IP ranges.
★ When this WOULD be the correct answer
This option would be correct if the question required restricting access to the web app based on a specific set of public IP addresses (e.g., from a branch office with a static public IP) and did not involve private IP addresses or virtual network integration.
Why candidates choose this
Candidates may mistakenly think that IP restrictions can filter private IPs from a virtual network, not realizing that Azure App Service access restrictions only support public IP ranges unless using private endpoints or service endpoints.
✗A public load balancer in front of the web app.Wrong answer — click to see why▾
Why this is wrong here
A public load balancer distributes traffic to the web app over the internet, not restricting access to private IP addresses from the corporate virtual network. It does not enforce private connectivity.
★ When this WOULD be the correct answer
If the question required distributing incoming internet traffic across multiple App Service instances for high availability and scalability, a public load balancer would be the correct choice.
Why candidates choose this
Candidates may think a load balancer can provide access control by filtering traffic, but it operates at the network level and does not inherently restrict to private IPs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure App Service
Azure App Service is a fully managed platform for building, deploying, and scaling web applications and APIs without managing the underlying infrastructure.
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.