Restricting Azure AI Language Access with Virtual Network Rules

AI-103 By islever Editorial Last updated

Manage, monitor, and secure AI systems Set up AI solutions in Foundry

Short answer

D Add virtual network rules in the Language resource firewall so only traffic from your approved subnet can reach the endpoint.

Question

You are building a solution in Azure that will use Azure Language in Foundry Tools service to process sensitive customer data.
You need to ensure that only specific Azure processes can access the Language service. The solution must minimize administrative effort.
What should you include in the solution?
  1. Azure Application Gateway
  2. a virtual network gateway
  3. IPsec rules
  4. virtual network rules Correct Answer

Key Takeaways

The question tests Azure AI services firewall options; the trap is confusing network encryption (IPsec/VPN) with per-resource access control by subnet.

To limit Azure AI Language in Foundry Tools to specific Azure processes with minimal setup, use virtual network rules in the resource's built-in firewall rather than gateways or IPsec.

Common mistake: Option C, IPsec rules, sounds security-related but only encrypts a VPN tunnel and implies an on-premises connection; it does not restrict which Azure processes may call the Language endpoint.

Expert Analysis

Reading the two qualifiers The question stacks two filters, and each one eliminates options. "Only specific Azure processes can access the Language service" means the control must be based on where the caller runs (its subnet/VNet), not on an IP range or on an intermediary appliance. "Minimize administrative effort" then rejects anything that requires building, deploying and maintaining a separate network construct before the rule can work.

Option A — Azure Application Gateway An Application Gateway is a managed Layer-7 load balancer (optionally with WAF) placed in front of web workloads. It is not in the call path of an SDK or REST request to a Language endpoint, and fronting a PaaS resource with it would not stop other callers from reaching the endpoint directly. It fails both qualifiers.

Option B — virtual network gateway A virtual network gateway is a VPN/ExpressRoute router that connects networks to each other. It is not a per-resource access-control setting on the Language resource, and it demands a gateway subnet, a public IP address and tunnel configuration — clearly not minimal effort.

Option C — IPsec rules IPsec is the encryption/tunnel policy used by site-to-site VPN connections, typically implying an on-premises link. It protects traffic in transit but does not define which Azure processes may call the endpoint. One comment votes C yet its own reasoning concedes IPsec "is not the appropriate" mechanism; the vote contradicts the justification and should not sway the decision.

Option D — virtual network rules This is the match. Azure AI Language exposes a built-in firewall under Networking where you switch from "All networks" to "Selected networks" and add virtual networks/subnets using service endpoints (or private endpoints). Only traffic originating from the approved subnet is admitted, the path stays on the Azure backbone, and it costs a few portal clicks or one template stanza. Virtual network rules satisfy both constraints, so D is correct.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read the effort qualifier first: when a question asks to restrict a PaaS endpoint with minimal administrative work, shortlist the resource's own firewall features (network rules, private endpoints) before any network appliance. Then eliminate options that solve a different problem — gateways connect networks, IPsec encrypts tunnels, and Application Gateway terminates web traffic — and pick the one that controls who reaches the resource.

Frequently Asked Questions

How do virtual network rules differ from private endpoints for Azure AI Language?

Virtual network rules use service endpoints so approved subnets reach the resource over the Azure backbone; private endpoints give the resource a private IP inside your VNet. Both restrict access, but virtual network rules are quicker to configure, which matches the minimal-effort requirement.

Why is IPsec not the right choice for restricting the Language service?

IPsec is the encryption policy behind site-to-site VPN tunnels and typically implies an on-premises connection. It protects traffic in transit but does not grant or deny access based on the calling Azure process's subnet.

Does Azure AI Language also allow IP-based firewall rules?

Yes, the same firewall supports IP rules for public address ranges, but those suit on-premises callers. For Azure-hosted processes, virtual network rules are the precise and lowest-effort control.

More AI-103 FAQ →

Community Votes

D
75%
C
25%

75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Srikantha 👍 2 Answered D
    Why this is correct: Virtual network rules (VNet firewalls) on the Azure AI Language resource allow you to restrict incoming traffic so that only applications or workloads running within designated Azure Virtual Network subnets can access the endpoint. This natively secures sensitive customer data by isolating PaaS access to authorized Azure processes with minimal administrative effort, eliminating the need to deploy or manage additional networking infrastructure.
  2. Amelia233 👍 1 Answered C
    Virtual network rules allow you to restrict access to the Azure Language service to specific virtual networks and subnets, helping protect sensitive customer data with minimal administration. A ❌ Application Gateway — manages web traffic, not direct service access control. B ❌ Virtual network gateway — connects networks but doesn't provide this access restriction. C ❌ IPsec rules — not the appropriate Azure Language access-control mechanism. D ✅ Virtual network rules — restrict access to trusted Azure network resources. Answer: D
  3. 8ac3742 👍 1 Answered D
    vNet Azure AI Language supports virtual network rules (Service Endpoints) directly in its built-in firewall. With a couple of clicks in the portal (or a simple template), you select the subnet where your Azure compute/processes live and allow it. Azure’s internal software-defined network automatically secures the path over the Azure backbone with zero VPNs, zero encryption tunnel management, and minimal administrative effort
  4. a5f05ea 👍 1 Answered D
    Restrict an Azure service to selected VNets/subnets → Virtual network rules Connect/encrypt traffic between networks → VPN/IPsec ✅ Therefore, D is correct, not C.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Request Parameters Maximize Foundry Output Stability and Reasoning?

S-grade

Azure Custom Vision: ordered steps to detect factory component faults

S-grade

Improving Agent Response Completeness in Microsoft Foundry

S-grade

Restricting Access to Microsoft Foundry Service via VNet

S-grade

Practice All AI-103 Questions

Access 88 questions with complete answers and detailed explanations.

View Full AI-103 Practice Test →

← Back to AI-103 Study Guide