AZ104-Q: Restricting storage to a specific VNet
Q: A storage account must be reachable only from resources inside a specific VNet, with traffic staying on the Microsoft backbone (not the public internet). What configuration is required?
- A) Share the access key with the VNet
- B) Disable public access (storage firewall) and connect via a private endpoint ✓
- C) Issue a SAS token with a long expiry
- D) Enable CORS
Answer: B. Set the storage account’s firewall / public access to “Disabled” so it is not exposed to the internet, then provision a private endpoint that gives the account a private IP inside your VNet, keeping traffic on the Microsoft backbone. Access keys/SAS (A, C) are authentication mechanisms — they grant access regardless of network, and don’t restrict to a VNet. CORS (D) governs browser cross-origin requests, not network access.
Why it helps
Modern storage security = public access off + private endpoint for VNet-only, backbone traffic. This is a frequent exam pairing.