How to Restrict Access to Azure AI Language Service?
You are building a solution in Azure that will use Azure Cognitive Service for Language to process sensitive customer data. You need to ensure that only specific Azure processes can access the Language service. The solution must minimize administrative effort. What should you include in the solution?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests which Azure-native control restricts inbound access to an AI service; the trap is picking VPN or gateway components that merely transport traffic instead of gating who may call the Language endpoint.
Azure AI Language (Cognitive Services) can be locked down with virtual network rules so only selected Azure subnets and the processes running in them can reach the endpoint. This page confirms virtual network rules (D) as the AI-102 answer, because they deliver the required isolation with the least administrative effort.
Choosing a virtual network gateway or IPsec rules because they sound secure — they protect tunnels between networks, not inbound access to the Language service, and a gateway requires substantial extra networking administration.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Virtual network rules on the Azure AI Language (Cognitive Services) resource firewall restrict inbound access to specific virtual network subnets, and you configure them once in the resource's Networking blade. Azure then enforces the allow-list for those subnets, so only the designated Azure processes can call the service, which directly satisfies the requirement while minimizing administrative effort. As Harry300 notes, this is exactly the approach Microsoft documents in its Cognitive Services virtual networks article. syupwsh summarised the mechanism well: virtual network rules "restrict access to the Language service to specific Azure resources within a virtual network." No tunnel, gateway appliance, or reverse proxy has to be built or maintained.Why the Other Options Are Wrong
IPsec rules (A) secure traffic inside an already established VPN or tunnel but do not by themselves authorize callers of the Language endpoint — rookiee1111 puts it correctly that "IPsec is for securing an already established channel". Azure Application Gateway (B) is a layer-7 reverse proxy and load balancer for inbound web traffic to your own applications; it does not provide an access-control list for a Cognitive Services resource and adds a component to operate. A virtual network gateway (C) exists for site-to-site, point-to-site, or ExpressRoute connectivity; it can carry traffic but does not create the service-level firewall rule, and it demands considerable networking administration, the opposite of "minimize administrative effort". michaelmorar's remark that the item feels closer to AZ-104 reminds us that the security control, not the gateway plumbing, is what is being tested.Community Comment Notes
Every voter in this thread converged on the same option: takaimomoGcup wrote "I believe D is right answer", while Mattt and dragongoseki simply confirmed D. Harry300 supplied the authoritative Microsoft Learn link on Cognitive Services virtual networks, which matches the service-level firewall approach. rookiee1111 gave the clearest rationale — virtual network rules restrict access to services in approved IP ranges, and a gateway would be "too much of an effort". syupwsh added that this leverages Azure's built-in network security to minimize administration.Official Reference
Exam Strategy
When an AI-102 question asks how to limit access to a Cognitive Services or Azure AI service with minimal effort, look for a native resource-level control such as virtual network rules, private endpoints, or IP firewall rules. Ask whether each option filters who may call the service or merely transports traffic — only the former answers the question.
Frequently Asked Questions
Why are virtual network rules better than a virtual network gateway here?
Virtual network rules directly filter which subnets may reach the Language service, while a gateway only provides connectivity and adds network infrastructure you must manage.
Do IPsec rules secure access to the Azure AI Language endpoint?
No. IPsec protects traffic inside an existing tunnel; it does not authorize or block callers of the service, so it cannot meet the access requirement.