nerdexam
Microsoft

AZ-104 · Question #521

Hotspot Question You have an Azure subscription that contains two storage accounts named contoso101 and contoso102. The subscription contains the virtual machines shown in the following table. VNet1 h

The correct answer is VM1 can access contoso102. = Yes; VM2 can access contoso101. = Yes; VM2 uses a private IP address to access Azure AD. = No. VM1 resides in Subnet1 which has the Microsoft.Storage service endpoint with a service endpoint policy restricting access to only contoso101. However, VM1 can still access contoso102 because the service endpoint policy applies restrictions only to traffic going through the servic

Submitted by ricky.ec· Mar 4, 2026Configure and manage virtual networking - specifically implementing VNet service endpoints and service endpoint policies to control access to Azure PaaS services (AZ-104: Implement and Manage Virtual Networking)

Question

Hotspot Question You have an Azure subscription that contains two storage accounts named contoso101 and contoso102. The subscription contains the virtual machines shown in the following table. VNet1 has service endpoints configured as shown in the Service endpoints exhibit. (Click the Service endpoints tab.) The Microsoft.Storage service endpoint has the service endpoint policy shown in the Microsoft.Storage exhibit. (Click the Microsoft.Storage tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-104 question #521 exhibit 1
AZ-104 question #521 exhibit 2
AZ-104 question #521 exhibit 3
AZ-104 question #521 exhibit 4

Answer Area

  • VM1 can access contoso102.Yes
  • VM2 can access contoso101.Yes
  • VM2 uses a private IP address to access Azure AD.No

Explanation

VM1 resides in Subnet1 which has the Microsoft.Storage service endpoint with a service endpoint policy restricting access to only contoso101. However, VM1 can still access contoso102 because the service endpoint policy applies restrictions only to traffic going through the service endpoint - VM1 can access contoso102 via the public internet path (not through the service endpoint), bypassing the policy restriction. VM2 is in Subnet2 which does NOT have the Microsoft.Storage service endpoint configured, so it accesses storage accounts (including contoso101) over the public internet using its public IP, making the second statement true. For the third statement, Azure AD is not a service that supports VNet service endpoints - service endpoints are available for services like Storage, SQL, KeyVault, etc., but NOT Azure Active Directory - therefore VM2 cannot use a private IP (service endpoint) to access Azure AD, making that statement No/False.

Topics

#VNet Service Endpoints#Service Endpoint Policies#Azure Storage Networking#Azure Virtual Network

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice