AZ-900 Describe Azure architecture and services Practice Question
A company stores sensitive customer data in an Azure Blob Storage account. The company's security policy requires that all data traffic between the virtual network (VNet) and the storage account must never traverse the public internet. Additionally, the storage account must remain accessible from an on-premises data center through a Site-to-Site VPN connection. Which Azure feature should the company configure on the storage account?
⚠ Common exam trap
It's easy for candidates to confuse Azure service endpoints with private endpoints, thinking both provide the same level of isolation, but service endpoints still expose the public endpoint and do not guarantee that traffic from on-premises over a VPN stays off the public internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Private Link (using a private endpoint)
Azure Private Link with a private endpoint is correct because it assigns a private IP address from the VNet to the storage account, ensuring all traffic between the VNet and the storage account stays within the Microsoft Azure backbone network and never traverses the public internet. Additionally, the storage account can still be accessed from an on-premises data center via a Site-to-Site VPN connection that terminates in the same VNet, as the private endpoint is reachable over the VPN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure service endpoints
Why it's wrong here
Service endpoints extend the VNet identity to Azure services, but traffic still reaches the public endpoint of the storage account. While service endpoints keep traffic on the Microsoft backbone, they do not provide a private IP address; the storage account remains accessible via its public IP address, which is not desired when the policy explicitly forbids any traffic traversing the public internet. Additionally, service endpoints do not natively support on-premises access to the storage account via a Site-to-Site VPN without additional configuration.
When this WOULD be correct
A company wants to secure access to an Azure storage account from a specific VNet without using a private IP address, and the security policy only requires that traffic from the VNet stays on the Microsoft backbone, not that it avoids the public internet entirely. On-premises access is not required.
- ✓
Azure Private Link (using a private endpoint)
Why this is correct
A private endpoint creates a network interface with a private IP address in the VNet. Traffic to the storage account goes over the Microsoft backbone without ever leaving the VNet or touching the public internet. Because the storage account appears inside the VNet, on-premises access via Site-to-Site VPN is naturally possible. This meets both requirements.
- ✗
Azure VPN Gateway connection to the storage account
Why it's wrong here
An Azure VPN Gateway provides encrypted connectivity between on-premises and an Azure VNet. However, it does not secure the storage account itself. Without a private endpoint, the storage account still uses a public endpoint, and traffic from the VNet to the storage account would leave the VNet over the public internet (or via Microsoft backbone if service endpoints are configured).
When this WOULD be correct
A company needs to connect an on-premises data center to an Azure VNet securely over the internet, and the storage account must be accessed via the VNet using a VPN connection. In this case, configuring a VPN Gateway on the VNet would be correct.
- ✗
Azure route tables
Why it's wrong here
Route tables control custom routing within a VNet. While they can force traffic to use a specific next hop (e.g., a firewall or VPN appliance), they cannot change the fact that the storage account's public endpoint is reachable over the internet. Route tables do not provide private connectivity to Azure PaaS services.
When this WOULD be correct
A company has multiple subnets in a VNet and needs to control traffic flow between them, such as forcing all traffic from a front-end subnet to a back-end subnet through a network virtual appliance (NVA). Route tables would be the correct feature to configure custom routes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Private Link (using a private endpoint)Correct answer▾
Why this is correct
A private endpoint creates a network interface with a private IP address in the VNet. Traffic to the storage account goes over the Microsoft backbone without ever leaving the VNet or touching the public internet. Because the storage account appears inside the VNet, on-premises access via Site-to-Site VPN is naturally possible. This meets both requirements.
✗Azure service endpointsWrong answer — click to see why▾
Why this is wrong here
Azure service endpoints allow traffic from a VNet to Azure services over the Microsoft backbone, but they do not ensure that traffic never traverses the public internet; they still use the public endpoint of the storage account. Additionally, service endpoints do not provide connectivity from on-premises via Site-to-Site VPN.
★ When this WOULD be the correct answer
A company wants to secure access to an Azure storage account from a specific VNet without using a private IP address, and the security policy only requires that traffic from the VNet stays on the Microsoft backbone, not that it avoids the public internet entirely. On-premises access is not required.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, thinking both provide private connectivity, but service endpoints do not assign a private IP and still expose the public endpoint.
✗Azure VPN Gateway connection to the storage accountWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway connects on-premises networks to Azure VNets over the public internet, but it does not ensure that traffic between a VNet and a storage account stays within the Microsoft backbone network. Private Link is required to keep traffic off the public internet.
★ When this WOULD be the correct answer
A company needs to connect an on-premises data center to an Azure VNet securely over the internet, and the storage account must be accessed via the VNet using a VPN connection. In this case, configuring a VPN Gateway on the VNet would be correct.
Why candidates choose this
Candidates may confuse Site-to-Site VPN with the requirement to keep traffic off the public internet, thinking that a VPN tunnel inherently provides private connectivity, but it does not prevent traffic from traversing the internet between the VNet and storage account.
✗Azure route tablesWrong answer — click to see why▾
Why this is wrong here
Route tables control traffic routing within a VNet but do not provide private connectivity to Azure PaaS services like Blob Storage. They cannot ensure traffic between a VNet and a storage account stays off the public internet, nor do they enable on-premises access via Site-to-Site VPN.
★ When this WOULD be the correct answer
A company has multiple subnets in a VNet and needs to control traffic flow between them, such as forcing all traffic from a front-end subnet to a back-end subnet through a network virtual appliance (NVA). Route tables would be the correct feature to configure custom routes.
Why candidates choose this
Candidates may confuse route tables with network security groups or think that custom routing can force traffic through a private path, but route tables only affect traffic within the VNet and do not provide private connectivity to PaaS services.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.