Pass Your Microsoft AZ-104 Exam Easy!

Enabling a storage service endpoint on a different subnet does not grant access to the subnet where this client actually originates. Storage firewall virtual-network rules must include the appropriate authorized subnet, and the service endpoint must apply to that same network path. This scenario says endpoint activation is complete but storage still denies the caller, so verify the precise effective subnet identity in the storage VNet rules. Adding an unrelated subnet would not repair the denied source and could grant access to unintended workloads.

'Check the product-specific supported service endpoint and subnet constraints' solves another task because service endpoints are not universal for every Azure service; choose a supported alternative when absent. For the situation where Storage still denies a subnet after service endpoint activation, this distractor misses the requirement that service endpoint enablement alone doesn't automatically authorize the subnet on the account firewall. Unlike 'Check the product-specific supported service endpoint and subnet constraints', 'Add the actual subnet to the storage account's allowed VNet rules' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a subnet may reach Azure Storage but only approved company storage accounts, the action 'Use a storage service endpoint policy where compatible' can be relevant: endpoint policies restrict which service resources the subnet can access beyond generic service route enablement. For the different problem of Storage still denies a subnet after service endpoint activation, 'Use a storage service endpoint policy where compatible' misses the mechanism that service endpoint enablement alone doesn't automatically authorize the subnet on the account firewall. Choosing 'Use a storage service endpoint policy where compatible' would address that other need, whereas 'Add the actual subnet to the storage account's allowed VNet rules' is intended to solve the stated condition.

The nearby action 'Check the product-specific supported service endpoint and subnet constraints' is associated with this separate need: a team configures a service endpoint for an Azure PaaS product without confirming that service supports it. That is because service endpoints are not universal for every Azure service; choose a supported alternative when absent. Here after enabling a service endpoint, old storage firewall IP rules no longer appear to match source traffic, so 'Check the product-specific supported service endpoint and subnet constraints' misses the fact that Azure service endpoints change how service traffic is identified; relying on old public source IP assumptions can fail. 'Use the proper service endpoint VNet network rule and verify route/source behavior' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use a private endpoint when a private IP in the VNet is required' solves another task because service endpoints connect to a service's public endpoint with subnet identity, not private IP allocation. For the situation where after enabling a service endpoint, old storage firewall IP rules no longer appear to match source traffic, this distractor misses the requirement that Azure service endpoints change how service traffic is identified; relying on old public source IP assumptions can fail. Unlike 'Use a private endpoint when a private IP in the VNet is required', 'Use the proper service endpoint VNet network rule and verify route/source behavior' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Azure Storage service endpoints allow the storage firewall to identify traffic by the configured virtual network subnet rather than relying solely on the former public egress IP. If the endpoint now governs the path, repeating the old public IP allow-list entry can leave the subnet denied. Review effective source routing and create the correct storage account VNet rule for the authorized subnet. This alternative persists with the wrong source identity and does not repair the mismatch the question specifically describes.

Adding the subnet to each approved storage account's VNet firewall rules controls which networks those storage accounts accept. It does not stop the same subnet from contacting a third storage account whose owner allows internet or service endpoint traffic. The scenario explicitly requires controlling outbound destinations from the subnet, not merely enabling ingress to two permitted accounts. An Azure Storage service endpoint policy can allow-list eligible service resources for traffic from the associated subnet. Use account firewall rules as complementary authorization rather than as a subnet-wide destination filter.

An NSG destination service tag such as Storage represents a broad set of service IP address ranges, not two individual Azure Storage account resource IDs. An outbound permit rule for that tag could therefore admit traffic to storage accounts beyond the approved list. Network security groups are appropriate for protocol, port and network-tuple filtering; they do not provide the resource-identity allow-list behavior required for storage service endpoints. Apply a supported service endpoint policy for the named accounts, and separately ensure storage firewalls and data-plane permissions are correct.

A private endpoint could provide private-IP access to a particular storage account and can be part of a separate, more private storage architecture. Simply creating those endpoints does not turn the existing Microsoft.Storage service endpoint into a subnet-wide allow-list, nor does it automatically deny requests that still use other storage public endpoints. This scenario keeps the service endpoint path by design. If the organization instead redesigns for Private Link, it would need corresponding DNS, routing and public-network-access policy decisions, which is a different change from the requested endpoint policy.

Azure Policy can audit or constrain the configuration of Azure resources at management-plane scopes, but an Audit effect alone is not an outbound packet filter on a VM subnet. A compliant resource inventory does not ensure that traffic from the subnet will be limited to two storage account IDs. The problem asks for an enforced destination restriction on an already established service endpoint path. A storage service endpoint policy is the purpose-built subnet-associated allow-list; test it with an approved and a nonapproved account while checking that required service dependencies are included.

When an Azure VM subnet accesses Blob Storage's public endpoint with strict storage VNet rules, the action 'Configure a Microsoft.Storage service endpoint plus matching subnet rule' can be relevant: service endpoints let approved VNet subnet identity reach a PaaS public service endpoint. For the different problem of a team configures a service endpoint for an Azure PaaS product without confirming that service supports it, 'Configure a Microsoft.Storage service endpoint plus matching subnet rule' misses the mechanism that service endpoints are not universal for every Azure service; choose a supported alternative when absent. Choosing 'Configure a Microsoft.Storage service endpoint plus matching subnet rule' would address that other need, whereas 'Check the product-specific supported service endpoint and subnet constraints' is intended to solve the stated condition.

'Use a private endpoint when a private IP in the VNet is required' applies to a different feature boundary because service endpoints connect to a service's public endpoint with subnet identity, not private IP allocation. In the stated scenario where a team configures a service endpoint for an Azure PaaS product without confirming that service supports it, 'Use a private endpoint when a private IP in the VNet is required' does not satisfy the mechanism that service endpoints are not universal for every Azure service; choose a supported alternative when absent. The necessary action is 'Check the product-specific supported service endpoint and subnet constraints', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use the proper service endpoint VNet network rule and verify route/source behavior' is associated with this separate need: after enabling a service endpoint, old storage firewall IP rules no longer appear to match source traffic. That is because Azure service endpoints change how service traffic is identified; relying on old public source IP assumptions can fail. Here a team configures a service endpoint for an Azure PaaS product without confirming that service supports it, so 'Use the proper service endpoint VNet network rule and verify route/source behavior' misses the fact that service endpoints are not universal for every Azure service; choose a supported alternative when absent. 'Check the product-specific supported service endpoint and subnet constraints' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Configure a Microsoft.Storage service endpoint plus matching subnet rule' applies to a different feature boundary because service endpoints let approved VNet subnet identity reach a PaaS public service endpoint. In the stated scenario where a storage service endpoint is active and the network path succeeds, but the app still lacks blob read rights, 'Configure a Microsoft.Storage service endpoint plus matching subnet rule' does not satisfy the mechanism that service endpoints govern network reachability, not data-plane identity roles. The necessary action is 'Grant Blob data authorization separately from the network endpoint rule', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Check the product-specific supported service endpoint and subnet constraints' is associated with this separate need: a team configures a service endpoint for an Azure PaaS product without confirming that service supports it. That is because service endpoints are not universal for every Azure service; choose a supported alternative when absent. Here a storage service endpoint is active and the network path succeeds, but the app still lacks blob read rights, so 'Check the product-specific supported service endpoint and subnet constraints' misses the fact that service endpoints govern network reachability, not data-plane identity roles. 'Grant Blob data authorization separately from the network endpoint rule' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use the proper service endpoint VNet network rule and verify route/source behavior' solves another task because Azure service endpoints change how service traffic is identified; relying on old public source IP assumptions can fail. For the situation where a storage service endpoint is active and the network path succeeds, but the app still lacks blob read rights, this distractor misses the requirement that service endpoints govern network reachability, not data-plane identity roles. Unlike 'Use the proper service endpoint VNet network rule and verify route/source behavior', 'Grant Blob data authorization separately from the network endpoint rule' directly targets that requirement; its success must be confirmed at the authorized resource scope.

A virtual-network service endpoint lets a configured subnet use the public service endpoint with network identity applied, but it does not create a private IP for the Storage service in that subnet. The question explicitly disables Storage public networking and asks for blob access through a private endpoint. Merely enabling a service endpoint cannot supply the required private destination or matching private DNS resolution. Instead, create an approved Storage blob Private Endpoint in an authorized subnet and arrange name resolution from each client to its private IP. Data-plane authorization must still be granted separately.

Granting Storage Blob Data Reader at an entire subscription is excessive when the client needs access only to a particular storage account or container, and broad Azure RBAC does not establish network reachability after public network access has been disabled. The application needs an approved private-endpoint connection and corresponding private DNS resolution, while its identity receives only the necessary blob DataActions at a narrow effective scope. Do not treat an overbroad subscription-level grant as a replacement for the private network path; authentication, authorization and routing are separate requirements.

Allowing Any public client IP on an account firewall contradicts the organization's requirement to disable public networking and use a private subnet. Storage firewall allowances for the public endpoint do not turn a public IP into a Private Endpoint. The requested solution establishes a private NIC connection under Private Link and makes the normal blob service hostname resolve to the private endpoint address for authorized clients. Keep public access disabled as required and validate network reachability and independent identity or SAS authorization rather than opening the account to internet sources.

A public Azure DNS zone can publish ordinary internet-facing resource records, but a standalone unlinked public zone cannot make a storage hostname resolve privately for selected virtual-network clients. Azure Storage Private Endpoint name resolution uses an appropriate private DNS zone such as privatelink.blob.core.windows.net, with the required A record and links or forwarding accessible to those VNets. The endpoint itself must also be created and approved. Creating only a new public DNS zone does neither, and can even confuse clients if it overrides the wrong authority. Validate the normal storage FQDN from the client.

'Complete supported private endpoint connection approval by the service owner' solves another task because cross-subscription private link connections can require explicit provider-side acceptance. For the situation where a VNet client must resolve a storage hostname to its new private endpoint IP, this distractor misses the requirement that private endpoint connectivity commonly relies on correct privatelink zone resolution for clients. Unlike 'Complete supported private endpoint connection approval by the service owner', 'Link and configure the appropriate private DNS zone and records' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Create a storage private endpoint with correct identity permissions and DNS' applies to a different feature boundary because a private endpoint gives a private network address to the storage service while data authorization remains separate. In the stated scenario where a VNet client must resolve a storage hostname to its new private endpoint IP, 'Create a storage private endpoint with correct identity permissions and DNS' does not satisfy the mechanism that private endpoint connectivity commonly relies on correct privatelink zone resolution for clients. The necessary action is 'Link and configure the appropriate private DNS zone and records', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Test private DNS, private route, endpoint approval and Blob data permission independently' is associated with this separate need: a storage account with public networking disabled has a healthy private endpoint but reads still fail. That is because a private IP path solves only network access; data-plane authorization may still deny the request. Here a VNet client must resolve a storage hostname to its new private endpoint IP, so 'Test private DNS, private route, endpoint approval and Blob data permission independently' misses the fact that private endpoint connectivity commonly relies on correct privatelink zone resolution for clients. 'Link and configure the appropriate private DNS zone and records' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Private endpoint provides private IP connectivity; service endpoint uses service public endpoint with subnet identity' solves another task because the two mechanisms differ in address, DNS and approval behavior. For the situation where a VNet client must resolve a storage hostname to its new private endpoint IP, this distractor misses the requirement that private endpoint connectivity commonly relies on correct privatelink zone resolution for clients. Unlike 'Private endpoint provides private IP connectivity; service endpoint uses service public endpoint with subnet identity', 'Link and configure the appropriate private DNS zone and records' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The application looks up its existing service hostname acct01.blob.core.windows.net, not a name entered directly under the private-link child namespace. Forwarding only the privatelink child can leave the initial public service-zone query on the ordinary corporate resolution path. Microsoft's private endpoint DNS integration guidance recommends conditional forwarding the service's public DNS zone name to the Azure-resident resolver so the CNAME and private-zone chain can be resolved correctly. Keeping the current forwarding scope unchanged would preserve the described public-result symptom.

Putting a private endpoint IP into publicly authoritative DNS would expose an internal address and bypass the controlled private-zone resolution design. Public DNS records cannot establish VPN routing, private endpoint approval, or data-plane authorization. The private A record is already correct in the linked Azure private zone, so duplicating it into an Internet zone would not fix which resolver handles the normal storage service hostname. Keep private endpoint answers in private DNS and use a conditional forwarding path through Azure that can consult that zone.

An Azure Private DNS zone is not automatically visible to corporate DNS merely because it exists or is linked to a VNet. A second unlinked zone creates more conflicting configuration without routing the on-premises blob.core.windows.net query to Azure. The presented private A record and zone link are already correct, and the inbound resolver is reachable. The missing detail is the conditional-forwarder zone name used for the initial storage FQDN. Forward the public Azure Blob service namespace rather than inventing another unlinked private-zone copy.

A private endpoint connection to the blob subresource provides private network access to that Blob service endpoint; it does not create a private endpoint for Azure Files. Granting a Blob data role does not authorize an SMB file share access path and does not create a file private IP or the corresponding private DNS record. The requirement here is a new storage subresource network connection, not an identity fix for Blob reads that already work. The team must separately consider Azure Files identity/share permissions after file private connectivity exists.

A service endpoint routes to an Azure PaaS service’s public endpoint using a VNet source identity; it does not create the private IP that the new file workload needs. Replacing the working Blob private endpoint would also remove the currently successful Blob private-link connectivity. With storage public network access disabled, relying solely on a service endpoint cannot substitute for an approved file private endpoint. Service endpoints may be appropriate for a different design with public endpoint access restrictions, but they do not meet the file subresource and private-address conditions stated here.

Azure Storage separates Blob and File endpoint subresources. Giving a file hostname the blob private endpoint’s IP does not turn Blob HTTPS service into the Azure Files SMB service; the protocol, target subresource and service endpoint are different. A manual CNAME or A record that bypasses the correct private endpoint integration can cause mismatched routing or failed connections while leaving actual file private connectivity absent. Instead create the file-specific private endpoint and use its matching private DNS configuration. After networking works, verify share-level role and file/directory permissions for SMB independently.

The nearby action 'Private endpoint provides private IP connectivity; service endpoint uses service public endpoint with subnet identity' is associated with this separate need: a user thinks a service endpoint and private endpoint are identical because both restrict PaaS traffic. That is because the two mechanisms differ in address, DNS and approval behavior. Here a customer VNet creates a private endpoint to a service owned by another subscription and sees Pending, so 'Private endpoint provides private IP connectivity; service endpoint uses service public endpoint with subnet identity' misses the fact that cross-subscription private link connections can require explicit provider-side acceptance. 'Complete supported private endpoint connection approval by the service owner' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Create a storage private endpoint with correct identity permissions and DNS' solves another task because a private endpoint gives a private network address to the storage service while data authorization remains separate. For the situation where a customer VNet creates a private endpoint to a service owned by another subscription and sees Pending, this distractor misses the requirement that cross-subscription private link connections can require explicit provider-side acceptance. Unlike 'Create a storage private endpoint with correct identity permissions and DNS', 'Complete supported private endpoint connection approval by the service owner' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a VNet client must resolve a storage hostname to its new private endpoint IP, the action 'Link and configure the appropriate private DNS zone and records' can be relevant: private endpoint connectivity commonly relies on correct privatelink zone resolution for clients. For the different problem of a customer VNet creates a private endpoint to a service owned by another subscription and sees Pending, 'Link and configure the appropriate private DNS zone and records' misses the mechanism that cross-subscription private link connections can require explicit provider-side acceptance. Choosing 'Link and configure the appropriate private DNS zone and records' would address that other need, whereas 'Complete supported private endpoint connection approval by the service owner' is intended to solve the stated condition.

Enabling public network access for every source would bypass the storage account's explicitly required private-only boundary. It might hide a DNS or routing mistake by allowing clients to reach the public endpoint, but that would not prove the private endpoint is functioning correctly. The endpoint can appear healthy in the Azure control plane while the application still resolves the public address or lacks data authorization. Keep public networking disabled, then test the client's actual DNS answer, private route and data-plane permission. Those three targeted checks distinguish network isolation failures from authorization failures without weakening security.

Subscription Owner is a powerful management-plane role, but a user does not automatically gain Microsoft Entra Blob Storage data read access merely by receiving that role. Some authorized principals may access account keys depending on settings and permissions, yet that is not evidence of least-privilege Blob DataActions for the application's identity. Elevating an operator to Owner would also leave a misrouted client or incorrect private DNS answer untouched. Check the caller's actual supported blob authorization mechanism and effective data permissions while separately validating DNS and the private endpoint network path. Broad Owner assignment is not an appropriate first diagnostic repair.

Creating another private endpoint without identifying the failed layer duplicates infrastructure and can add conflicting DNS records. The scenario already says an endpoint reports healthy; that status does not show whether the application resolves the correct storage hostname, can route to the private IP, or has permission to read the blob. Diagnose the existing endpoint's approval state, the client's network path and name resolution, and the caller's Blob data authorization before creating anything new. If a defect is found in one of those layers, correct that layer rather than adding a second endpoint blindly.