FirstTry

Exam objective

AZ-104

Configure access to storage

This objective sits in Implement and manage storage, which carries 19% of the Azure Administrator exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.

Objective title verbatim from the official objectives. Microsoft Azure exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Implement and manage storage

A firm needs private access to one specific Azure Storage account from both their virtual network and their on-premises network, without exposing the account over a public endpoint. Which option satisfies both requirements together?

Use Azure Private Link to access the specific storage instanceCorrect · your answerCorrect: Private Link privately reaches a specific service instance from both the virtual network and on-premises networks.
Configure a virtual network service endpoint for the storage accountService endpoints extend the vnet's identity to the service but still route over the service's public endpoint and do not cover on-premises access, so this fails the private on-premises requirement.
Configure virtual network peering between the two networksPeering only connects two virtual networks to each other, it does not provide private access to a storage service instance or to on-premises networks.
Deploy a network virtual appliance in the virtual networkA network virtual appliance performs functions like firewalling or WAN optimization, it does not provide private connectivity to a storage service instance.
Establish a point-to-site VPN connection for each computerPoint-to-site VPN connects individual computers to a virtual network, it does not by itself provide private access to a specific storage service instance.

Correct.

Checked against learn.microsoft.com, July 2026

Concept

Two different problems hide behind the phrase private access to storage. Extending a virtual network's identity to a service still routes over that service's public endpoint and only serves callers inside the network. Reaching one named resource privately, including from on-premises, needs a different mechanism.

Why A

Because the requirement includes on-premises access to one specific instance without a public endpoint, Private Link is the option built for that combination, unlike service endpoints which only cover the virtual network side.

Source

Use Azure Private Link to privately access a specific instance of the service from your virtual network and from on-premises networks.

Azure Virtual Network overview, checked July 2026
#storage#private-link#service-endpoint#on-premises-access

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Implement and manage storage

An administrator wants VMs in a virtual network to reach a storage account using the VNet's private address space and identity, without exposing the storage account to the general internet. Which option should be configured?

Sample question 2 of 3

Implement and manage storage

A company connects its on-premises datacenter to Azure over ExpressRoute. It must let both on-premises servers and VNet resources privately reach one specific storage account instance, not just any account of that resource type. Which option meets this?

Sample question 3 of 3

Implement and manage storage

An administrator adds an IP network rule of 10.20.0.0/16 to a storage account firewall for an on-premises subnet, and the portal rejects the rule. What is the cause?

Full Azure Administrator question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Implement and manage storage