Restricting Azure AI Service Access to Virtual Network

AI-102 By islever Editorial Last updated

Short answer

AE Enable a service endpoint in VNet1 and modify the virtual network settings on CSAccount1 to allow access only from the VNet subnets.

Question

You have an Azure subscription that contains an Azure AI Service resource named CSAccount1 and a virtual network named VNet1. CSAaccount1 is connected to VNet1. You need to ensure that only specific resources can access CSAccount1. The solution must meet the following requirements: • Prevent external access to CSAccount1. • Minimize administrative effort. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.
  1. In VNet1, enable a service endpoint for CSAccount1. Correct Answer
  2. In CSAccount1, configure the Access control (IAM) settings.
  3. In VNet1, modify the virtual network settings.
  4. In VNet1, create a virtual subnet.
  5. In CSAccount1, modify the virtual network settings. Correct Answer

Key Takeaways

The exam traps learners into choosing IAM (Option B) instead of Network Rules (Option E), confusing identity-based access control with network-based perimeter security.

This question tests configuring network isolation for Azure AI services by combining virtual network service endpoints with resource-level network rules.

Common mistake: Learners frequently select Option B (IAM) because it is a common security practice, but IAM controls *who* can access the API keys/endpoint, not *where* the traffic comes from. The requirement to prevent external access requires network-level filtering.

Expert Analysis

Why the Answer Is Correct

To restrict access to an Azure AI Service resource like CSAccount1 so that only specific resources within a VNet can reach it, you must implement a combination of connectivity and filtering. First, enabling a Service Endpoint in VNet1 (Option A) allows traffic from the VNet to route optimally over the Microsoft backbone network, bypassing the public internet. Second, modifying the virtual network settings on the CSAccount1 resource itself (Option E) allows you to configure 'Network Rules' (specifically adding the subnet ID). This creates a firewall-like restriction at the resource level, denying all traffic from networks other than the specified VNet subnets.

Why the Other Options Are Wrong

Option B (IAM) manages role assignments (e.g., Cognitive Services OpenAI User) which determines permissions after access is granted; it does not block IP addresses or external connections. Option C (Modify VNet settings) is vague and doesn't specify the mechanism (like Service Endpoints or NSGs) required for this specific service integration. Option D (Create a subnet) is a prerequisite step but does not inherently enforce access restrictions without further configuration.

Community Comment Notes

Many users correctly identified AE as the solution, noting that service endpoints provide the secure path while resource-level network settings act as the gatekeeper. Some users debated Option B, arguing that IAM is necessary for least privilege, but the community consensus clarified that IAM does not satisfy the 'prevent external access' requirement, which is strictly a network boundary issue. As one commenter noted, 'IAM controls do not necessarily help if the endpoint and key are compromised,' highlighting the need for network isolation.

Exam Strategy

Always distinguish between Identity Management (IAM/RBAC) and Network Security (Firewalls/VNET Rules). If the question asks to 'prevent external access' or 'isolate from the internet', look for Network Rules or Private Links first, not IAM roles.

Frequently Asked Questions

Why is Option B (IAM) incorrect for preventing external access?

IAM controls who has permission to use the API keys, but it does not filter the source IP address or network. External attackers with valid keys could still access the service.

What is the difference between Service Endpoints and Private Link here?

Service Endpoints optimize routing and add context to traffic. For this specific question, the 'modify virtual network settings' on the resource side refers to adding subnet IDs to the allowed networks list, which works with Service Endpoints.

More AI-102 FAQ →

Community Votes

AE
76%
AB
24%

76% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 19 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 19

  1. chandiochan 👍 11
    A. In VNet1, enable a service endpoint for CSAccount1. This allows you to secure your Azure service resources to the virtual network. E. In CSAccount1, modify the virtual network settings. This will allow you to configure CSAccount1 to accept connections only from the virtual network VNet1. Enabling service endpoints and modifying the virtual network settings for the AI Service resource will limit access to the resources within VNet1, effectively fulfilling both requirements.
  2. GHill1982 👍 5
    In VNet1, enable a service endpoint for CSAccount1. This will allow you to connect your virtual network to your Azure AI Service resource securely over the Azure backbone network. In CSAccount1, modify the virtual network settings. This will allow you to configure virtual network rules that specify which subnets can access your Azure AI Service resource.
  3. Murtuza 👍 4
    the correct answers are A (enable a service endpoint for CSAccount1) and B (configure the Access control (IAM) settings). These actions provide a secure and efficient solution for restricting access to CSAccount1 while minimizing administrative overhead.
  4. microsofter029 👍 3
    The other options are not suitable for achieving the desired security outcome in this scenario for the following reasons: C. Modify the virtual network settings: This option alone does not directly restrict access to CSAccount1. While modifying certain settings like network security groups (NSGs) could potentially be used, it would require additional configuration and wouldn't address access control within the virtual network. D. Create a virtual subnet: While creating a subnet within VNet1 could contribute to segmentation and potential security benefits, it's not sufficient on its own. You would still need to configure access control at the resource level (CSAccount1) and potentially implement additional security measures like NSGs within the subnet. E. Modify the virtual network settings in CSAccount1: CSAccount1 is an Azure AI service resource, and modifying its virtual network settings wouldn't be applicable in this context. These resources are not directly managed like virtual networks and do not have settings for virtual network configuration.
  5. NullVoider_0 👍 3
    A. In VNet1, enable a service endpoint for CSAccount1. Enabling a service endpoint for CSAccount1 in VNet1 will allow you to secure the Azure AI Service resource to a specific subset of networks. This means that only the applications requesting data over VNet1 will be able to access CSAccount1. It’s a way to ensure that the resource is only accessible from within the virtual network. E. In CSAccount1, modify the virtual network settings. By modifying the virtual network settings in CSAccount1, you can configure network rules that limit access to the resource. You would set the default network access rule to deny access to all networks, including the internet. Then, you can specify which virtual networks or subnets are allowed to access CSAccount1.
Show 14 more comments
  1. Jimmy1017 👍 3
    A. In VNet1, enable a service endpoint for CSAccount1. B. In CSAccount1, configure the Access control (IAM) settings. Explanation: A. Enabling a service endpoint for CSAccount1 in VNet1 allows traffic from the virtual network to reach CSAccount1 without traversing the public internet, thus preventing external access. B. Configuring the Access control (IAM) settings in CSAccount1 allows you to specify which specific resources or identities have access to CSAccount1. By configuring these settings, you can ensure that only specific resources can access CSAccount1, meeting the requirement to restrict access.
  2. TT924 👍 2
    A. Enable a service endpoint for Azure AI services within the virtual network. The service endpoint routes traffic from the virtual network through an optimal path to the Azure AI service. https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/role-based-access-control B. Has default multiple Role-base access: Cognitive Services OpenAI User, Cognitive Services OpenAI Contributor, Cognitive Services Contributor, Cognitive Services Usages Reader You can also set up Azure RBAC for whole resource groups, subscriptions, or management groups. Do this by selecting the desired scope level and then navigating to the desired item. For example, selecting Resource groups and then navigating to a specific resource group. Select Access control (IAM) on the left navigation pane. https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/role-based-access-control
  3. rookiee1111 👍 2
    A - creating a service endpoint for csaccount1 on vnet1 ensures that its the only way of accessing the service and it ensures a secure connection E - adding network settings on service csaccount1 will ensure that the access is restricted to resources within vnet1
  4. AzureGC 👍 2
    AE ... Do NOT think B is correct: The IAM controls do not necessarily help if the endpont and key are compromised; Have to use VNET controls to gate the service endpoints;
  5. Nat69 👍 1
    To ensure that only specific resources can access CSAccount1 and prevent external access while minimizing administrative effort, you should perform the following actions: A. In VNet1, enable a service endpoint for CSAccount1. E. In CSAccount1, modify the virtual network settings. Explanation: Enable a Service Endpoint for CSAccount1 (Action A): Service endpoints provide direct connectivity to Azure services over an optimized route over the Azure backbone network. By enabling a service endpoint for CSAccount1 on VNet1, you ensure that the traffic between VNet1 and CSAccount1 does not go over the internet, enhancing security and meeting the requirement to prevent external access. Modify the Virtual Network Settings in CSAccount1 (Action E): Configuring the virtual network settings in CSAccount1 allows you to specify which subnets within VNet1 can access the AI service. This way, you can control access at a more granular level and ensure that only specific resources within those subnets can access CSAccount1.
  6. Belicova 👍 1
    From copilot : To achieve the desired requirements of preventing external access to CSAccount1 while minimizing administrative effort, consider the following actions: Configure network rules for CSAccount1: Go to the Azure AI services resource you want to secure. Under Firewalls and virtual networks, select Selected Networks and Private Endpoints. Deny access by default to all networks, including internet traffic. Then, configure rules to grant access only to traffic from specific virtual networks1. Create a virtual subnet in VNet1: This allows you to isolate resources within a specific subnet, ensuring that only authorized traffic can reach CSAccount1. Therefore, the correct answers are A. In VNet1, enable a service endpoint for CSAccount1 and D. In VNet1, create a virtual subnet. These actions align with the requirements and minimize administrative overhead.
  7. syupwsh 👍 1
    Enabling a service endpoint for CSAccount1 is correct because service endpoints allow secure and direct connectivity to Azure services over an optimized route within the Azure backbone network. This helps in preventing external access to CSAccount1 while ensuring the resource is accessible within the virtual network (VNet1). Modifying the virtual network settings in CSAccount1 is correct because this involves configuring the service to limit access to specific virtual networks and subnets, effectively preventing unauthorized external access. This configuration ensures that only resources within the specified virtual network can access CSAccount1, meeting the requirement of minimal administrative effort by leveraging built-in network security features. AE are the answers
  8. PeteColag 👍 1
    Dervices like Azure AI Search, Video Indexer, and Immersive Reader do not support VNet settings configuration. For such services, E is not a viable response.
  9. p2006 👍 1
    https://learn.microsoft.com/en-us/azure/ai-services/cognitive-services-virtual-networks?tabs=portal#configure-virtual-network-rules
  10. anto69 👍 1
    ChatGPT confirms A and E
  11. reiwanotora 👍 1
    I will also vote for AE.
  12. franceshuang 👍 1
    AE should be right
  13. anto69 👍 1
    ChatGPT: A and E
  14. nanaw770 👍 1
    A and E.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Minimizing Dev Effort for Stream Anomaly Alerts

S-grade

Indexing Large OneDrive Files with Azure Video Indexer

S-grade

Maximizing Azure OpenAI Chatbot Response Accuracy

S-grade

OpenAI CLI Data Preparation Tool Supported File Formats

S-grade

← Back to AI-102 Study Guide