Restricting Access to Microsoft Foundry Service via VNet
Short answer
AC Modify the virtual network settings in CSAccount1 to restrict access and enable a service endpoint in VNet1 to route traffic securely.
Question
You need to ensure that only specific resources can access CSAccount1. The solution must meet the following requirements:
• Prevent external access to CSAccount1.
• Minimize administrative effort.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct answer is worth one point.
Key Takeaways
The core concept is using Azure networking features to isolate AI services from the public internet, with the common trap being confusion between IAM (identity) and Network Security (network).
This question addresses how to secure a Microsoft Foundry Service resource by restricting network access. The correct solution involves configuring virtual network settings within the service and enabling service endpoints in the connected virtual network.
Common mistake: Many learners incorrectly choose IAM (Option D) because it controls 'who' can access resources, but the requirement specifically asks to prevent 'external access' (network level), which IAM cannot do alone without network restrictions.
Expert Analysis
Why the Answer Is Correct
To prevent external access to the Microsoft Foundry Service (CSAccount1), you must restrict its network connectivity. Modifying the virtual network settings in CSAccount1 (Option A) allows you to disable public network access or configure allowed networks. Enabling a service endpoint for the Foundry service in VNet1 (Option C) ensures that traffic from the virtual network travels over the Azure backbone rather than the public internet, satisfying the 'prevent external access' requirement while minimizing administrative effort compared to Private Endpoints.
Why the Other Options Are Wrong
Option B (creating a subnet) is a prerequisite but does not inherently restrict access. Option D (IAM) manages identity-based permissions (RBAC), not network-level access control; a user with IAM rights could still access the resource if the network is open. Option E suggests modifying VNet settings directly, but the restriction configuration happens on the Service side (CSAccount1) by whitelisting the VNet/subnet, making A the more precise action for the service configuration.
Community Comment Notes
Community consensus strongly supports options A and C. Users like Srikantha and AzureGeek79 note that combining service network settings with VNet endpoints is the standard pattern for this security requirement. One commenter explicitly stated, 'Correct answers: A & C', highlighting the synergy between the service-side config and the network-side endpoint.
Exam Strategy
When a question asks to 'prevent external access', prioritize network isolation techniques (Service Endpoints, Private Links, VNet Settings) over Identity management (IAM). Always check if the question implies routing traffic away from the public internet.
Frequently Asked Questions
Why not use IAM (Option D) to restrict access?
What is the difference between Action A and Action E?
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
Srikantha 👍 2ignore the previous Enable a service endpoint for CSAccount1 in VNet1 (Action A): This securely connects your virtual network to the Azure AI service resource over the Azure backbone network, routing traffic away from the public internet and helping satisfy the requirement to prevent external access. Modify the virtual network settings in CSAccount1 (Action E): This allows you to restrict network access directly on the resource by setting access rules that block public traffic and permit only designated virtual networks and subnets, keeping administrative overhead minimal compared to configuring complex firewalls or routing mechanisms.
-
Srikantha 👍 2Enable a service endpoint for CSAccount1 in VNet1 (Action A): This securely connects your virtual network to the Azure AI service resource over the Azure backbone network, routing traffic away from the public internet and helping satisfy the requirement to prevent external access. Modify the virtual network settings in CSAccount1 (Action E): This allows you to restrict network access directly on the resource by setting access rules that block public traffic and permit only designated virtual networks and subnets, keeping administrative overhead minimal compared to configuring complex firewalls or routing mechanisms.
-
8ac3742 👍 1To allow resources inside VNet1 to reach an Azure PaaS service (CSAccount1) privately over the Azure backbone, you must enable a Virtual Network Service Endpoint (specifically for Microsoft.CognitiveServices) on VNet1's subnet. This provides the network route from the VNet to the service without traversing the public internet. In CSAccount1 under Firewalls and Virtual Networks, you switch the firewall from All Networks to Selected Networks and Private Endpoints, and add VNet1 to the allowed list. This turns on the firewall to reject all external/public internet connections.
-
a5f05ea 👍 1Correct answers: A and C A. In CSAccount1, modify the virtual network settings C. In VNet1, enable a service endpoint for CSAccount1
-
AzureGeek79 👍 1Correct answers: A & C
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AI-103 Questions
Access 88 questions with complete answers and detailed explanations.
View Full AI-103 Practice Test →