Exam AZ-104 topic 6 question 38 discussion

My answer: 2 First service endpoint: One service endpoint for Microsoft.Storage added to VNET1. The question asks how many to add to VNET1. When adding service endpoints on the VNET1 side you only get to choose the service ( Microsoft.Storage ) not the actual storage accounts. Once you add this service endpoint it can be then linked to on the storage side for both accounts. Second Service Endpoint: Microsoft.AzureActiveDirectory. Total:2

Should be B, 2 service endpoints. VM is not a service endpoint type. So the first question is irrelevant. Both storage accounts must have service endpoints in vnet 1, so awnser should be 2

Microsoft.AzureActiveDirectory as a service endpoint does not mean private access to the core Microsoft Entra ID (Entra ID) authentication/authorization service. It's largely a legacy or very specific integration point for other Azure services, not a general-purpose private link to your tenant's Entra ID. If the question is about accessing "Azure AD" broadly for authentication, authorization, etc., then no service endpoint is required or applicable for that core function. So, my refined answer, correcting the previous error, holds: For storage1 and storage2: 1 service endpoint (Microsoft.Storage) For Azure AD: 0 service endpoints (as direct access to core Entra ID doesn't use service endpoints) The total minimum number of service endpoints is 1.

one - for Azure AD you can access the other VMs by peering the VNets and the storage accounts by private endpoints (not service endpoints)

Additionally, I vote for A because KeyVault is not part of the requirements of the question. So, only 1 for the storages.

I vote for A: 1 service endpoint for Microsoft.Storage (for both storage1 and storage2) No service endpoint is required for Azure AD. VNET peering handles communication between VNET1 and VNET2, so there is not need for a service endpoint.

My answer: A One service endpoint is needed for all of the storage accounts. Azure AD doesn't need/support service endpoints and there is nothing mentioned about requirement for connectivity to key vault. So, only one service endpoint should be needed.

One for Microsoft.Storage One for Microsoft.AzureActiveDirectory

Communication with VNET2: To allow virtual machines in VNET1 to communicate with those in VNET2, you need a service endpoint for the Microsoft backbone network. This ensures that traffic between the two virtual networks stays within the Azure backbone, providing optimal connectivity. Access to Storage1 and Storage2: For virtual machines in VNET1 to access storage1 and storage2, you’ll need service endpoints for Azure Storage. These endpoints allow private IP addresses within VNET1 to reach Azure Storage services without requiring public IP addresses. Therefore, the minimum number of service endpoints to add to VNET1 is two: One for Microsoft backbone network (for communication with VNET2). Another for Azure Storage (for accessing storage1 and storage2). ANSwer: B

B is correct

One service endpoints for each Virtual Network that connects to storage accounts, so in this case only VNET1. On storage account there is no storage enpoint configuration. About connection on microsoft backbone beteween VNET1 and VNET2 such a service endpoint doesn't exist. About Service Endpoint: Microsoft.AzureActiveDirectory it's only for ADSL Gen 1. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview#limitations

storage endpoint for both storage accounts

The answer is A Here is the simplest proof: Service Endpoints cannot be connected to vNets associated to virtual machines. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

You need a separate private endpoint for each storage resource that you need to access, namely Blobs, Data Lake Storage Gen2, Files, Queues, Tables, or Static Websites. On the private endpoint, these storage services are defined as the target sub-resource of the associated storage account. https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

I think the answer is B. Why? To meet the requirements of allowing virtual machines in VNET1 to communicate with virtual machines in VNET2 using the Microsoft backbone, as well as allowing access to Azure services such as Azure AD and Azure Storage using the Microsoft backbone, you should configure the following service endpoints in VNET1: - You wouldn't use service endpoints to enable communication between the VNETs. (Peering would be the likely solution for VNET to VNET communication) - Microsoft.Storage (For access to storage1 and storage2) - Microsoft.AzureActiveDirectory (For access to Azure AD) These service endpoints will enable traffic between the virtual machines in VNET1 and Azure Storage accounts (storage1 and storage2) and Azure Active Directory using the Microsoft backbone network. So, the minimum number of service endpoints to add to VNET1 is 2: Microsoft.Storage and Microsoft.AzureActiveDirectory. Please correct me if i'm wrong!

Only for the storage

Only 1 service endpoint is required for Storage account