AZ104-Q: diagnose Private Endpoint access
A VM in a VNet cannot reach a Storage account after public network access was disabled and a Private Endpoint was created. The VM resolves the storage hostname to a public IP address. What should the administrator fix first?
- A) Add a public IP to the VM.
- B) Replace the Private Endpoint with a service endpoint.
- C) Assign Contributor to the VM’s managed identity.
- D) Configure the appropriate private DNS zone/link so the storage name resolves to the Private Endpoint private IP. ✓
Answer: D. Private Endpoint connectivity depends on name resolution reaching the endpoint’s private IP. A public result sends the client to an endpoint that has been disabled.
Why not the others: A public IP increases exposure and does not correct private DNS. A service endpoint is a different design. RBAC does not control network name resolution.