How to Restrict Access to Azure AI Language Service?
Short answer
D Add virtual network rules to the Azure AI Language service so only approved virtual network subnets and Azure resources can reach it.
Question
Key Takeaways
Tests which Azure-native control restricts inbound access to an AI service; the trap is picking VPN or gateway components that merely transport traffic instead of gating who may call the Language endpoint.
Azure AI Language (Cognitive Services) can be locked down with virtual network rules so only selected Azure subnets and the processes running in them can reach the endpoint. This page confirms virtual network rules (D) as the AI-102 answer, because they deliver the required isolation with the least administrative effort.
Common mistake: Choosing a virtual network gateway or IPsec rules because they sound secure — they protect tunnels between networks, not inbound access to the Language service, and a gateway requires substantial extra networking administration.
Expert Analysis
Why the Answer Is Correct
Virtual network rules on the Azure AI Language (Cognitive Services) resource firewall restrict inbound access to specific virtual network subnets, and you configure them once in the resource's Networking blade. Azure then enforces the allow-list for those subnets, so only the designated Azure processes can call the service, which directly satisfies the requirement while minimizing administrative effort. As Harry300 notes, this is exactly the approach Microsoft documents in its Cognitive Services virtual networks article. syupwsh summarised the mechanism well: virtual network rules "restrict access to the Language service to specific Azure resources within a virtual network." No tunnel, gateway appliance, or reverse proxy has to be built or maintained.
Why the Other Options Are Wrong
IPsec rules (A) secure traffic inside an already established VPN or tunnel but do not by themselves authorize callers of the Language endpoint — rookiee1111 puts it correctly that "IPsec is for securing an already established channel". Azure Application Gateway (B) is a layer-7 reverse proxy and load balancer for inbound web traffic to your own applications; it does not provide an access-control list for a Cognitive Services resource and adds a component to operate. A virtual network gateway (C) exists for site-to-site, point-to-site, or ExpressRoute connectivity; it can carry traffic but does not create the service-level firewall rule, and it demands considerable networking administration, the opposite of "minimize administrative effort". michaelmorar's remark that the item feels closer to AZ-104 reminds us that the security control, not the gateway plumbing, is what is being tested.
Community Comment Notes
Every voter in this thread converged on the same option: takaimomoGcup wrote "I believe D is right answer", while Mattt and dragongoseki simply confirmed D. Harry300 supplied the authoritative Microsoft Learn link on Cognitive Services virtual networks, which matches the service-level firewall approach. rookiee1111 gave the clearest rationale — virtual network rules restrict access to services in approved IP ranges, and a gateway would be "too much of an effort". syupwsh added that this leverages Azure's built-in network security to minimize administration.
Official Reference
https://learn.microsoft.com/en-us/azure/ai-services/cognitive-services-virtual-networks?tabs=portal
This link opens the official vendor documentation in a new tab.
Exam Strategy
When an AI-102 question asks how to limit access to a Cognitive Services or Azure AI service with minimal effort, look for a native resource-level control such as virtual network rules, private endpoints, or IP firewall rules. Ask whether each option filters who may call the service or merely transports traffic — only the former answers the question.
Frequently Asked Questions
Why are virtual network rules better than a virtual network gateway here?
Do IPsec rules secure access to the Azure AI Language endpoint?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 7 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 7
-
Harry300 👍 6 Answered DCorrect. Source: https://learn.microsoft.com/en-us/azure/ai-services/cognitive-services-virtual-networks?tabs=portal
-
rookiee1111 👍 4answer is virtual network rules. why? because it helps configure IP range address to restrict access to an end point only to services deployed in those IP ranges. this way the access can be restricted. Gateway can work but too much of an effort, and IPsec is for securing an already established channel of communication between 2 points.
-
michaelmorar 👍 2 Answered DThis question is more relevant to AZ104 (Azure Administration) rather than AI, but anyway, I reckon the answer is D.
-
syupwsh 👍 1 Answered Dvirtual network rules they allow you to restrict access to the Azure AI Language service to specific Azure resources within a virtual network. By configuring virtual network rules, you can ensure that only designated processes and services within your Azure infrastructure can access the Language service. This approach minimizes administrative effort by leveraging Azure's built-in network security capabilities. Answer is D
-
takaimomoGcup 👍 3 Answered DI believe D is right answer.
Show 2 more comments
-
Mattt 👍 1 Answered DD is correct
-
dragongoseki 👍 1 Answered DD is OK.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.