Restricting Access to Microsoft Foundry Service via VNet

Set up AI solutions in Foundry

You have an Azure subscription that contains a Microsoft Foundry Service resource named CSAccount1 and a virtual network named VNet1. CSAaccount1 is connected to VNet1. You need to ensure that only specific resources can access CSAccount1. The solution must meet the following requirements: • Prevent external access to CSAccount1. • Minimize administrative effort. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.

In CSAccount1, modify the virtual network settings. Correct Answer
In VNet1, create a virtual subnet.
In VNet1, enable a service endpoint for CSAccount1. Correct Answer
In CSAccount1, configure the Access control (IAM) settings.
In VNet1, modify the virtual network settings.

Answer Correct answer: A, C — Modify the virtual network settings in CSAccount1 to restrict access and enable a service endpoint in VNet1 to route traffic securely.

Community Insight

The core concept is using Azure networking features to isolate AI services from the public internet, with the common trap being confusion between IAM (identity) and Network Security (network).

This question addresses how to secure a Microsoft Foundry Service resource by restricting network access. The correct solution involves configuring virtual network settings within the service and enabling service endpoints in the connected virtual network.

Many learners incorrectly choose IAM (Option D) because it controls 'who' can access resources, but the requirement specifically asks to prevent 'external access' (network level), which IAM cannot do alone without network restrictions.

Community Discussion (4 comments)

AzureGeek79 👍 1 Selected: AC

Correct answers: A & C

a5f05ea 👍 1 Selected: AC

Correct answers: A and C A. In CSAccount1, modify the virtual network settings C. In VNet1, enable a service endpoint for CSAccount1

Srikantha 👍 2 Selected: AE

ignore the previous Enable a service endpoint for CSAccount1 in VNet1 (Action A): This securely connects your virtual network to the Azure AI service resource over the Azure backbone network, routing traffic away from the public internet and helping satisfy the requirement to prevent external access. Modify the virtual network settings in CSAccount1 (Action E): This allows you to restrict network access directly on the resource by setting access rules that block public traffic and permit only designated virtual networks and subnets, keeping administrative overhead minimal compared to configuring complex firewalls or routing mechanisms.

Srikantha 👍 2 Selected: AC

Enable a service endpoint for CSAccount1 in VNet1 (Action A): This securely connects your virtual network to the Azure AI service resource over the Azure backbone network, routing traffic away from the public internet and helping satisfy the requirement to prevent external access. Modify the virtual network settings in CSAccount1 (Action E): This allows you to restrict network access directly on the resource by setting access rules that block public traffic and permit only designated virtual networks and subnets, keeping administrative overhead minimal compared to configuring complex firewalls or routing mechanisms.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

To prevent external access to the Microsoft Foundry Service (CSAccount1), you must restrict its network connectivity. Modifying the virtual network settings in CSAccount1 (Option A) allows you to disable public network access or configure allowed networks. Enabling a service endpoint for the Foundry service in VNet1 (Option C) ensures that traffic from the virtual network travels over the Azure backbone rather than the public internet, satisfying the 'prevent external access' requirement while minimizing administrative effort compared to Private Endpoints.

Why the Other Options Are Wrong

Option B (creating a subnet) is a prerequisite but does not inherently restrict access. Option D (IAM) manages identity-based permissions (RBAC), not network-level access control; a user with IAM rights could still access the resource if the network is open. Option E suggests modifying VNet settings directly, but the restriction configuration happens on the Service side (CSAccount1) by whitelisting the VNet/subnet, making A the more precise action for the service configuration.

Community Comment Notes

Community consensus strongly supports options A and C. Users like Srikantha and AzureGeek79 note that combining service network settings with VNet endpoints is the standard pattern for this security requirement. One commenter explicitly stated, 'Correct answers: A & C', highlighting the synergy between the service-side config and the network-side endpoint.

Exam Strategy

When a question asks to 'prevent external access', prioritize network isolation techniques (Service Endpoints, Private Links, VNet Settings) over Identity management (IAM). Always check if the question implies routing traffic away from the public internet.

Frequently Asked Questions

Why not use IAM (Option D) to restrict access?

IAM controls who can perform actions, not where connections come from. To block external/public network access, you need network-level restrictions.

What is the difference between Action A and Action E?

Action A modifies the Service's allowed networks/VNet settings. Action E modifies general VNet properties. The restriction is applied by configuring the Service (A) to trust the VNet.

More AI-103 FAQ →

Related Analysis

Practice All AI-103 Questions

Access 88 questions with complete answers and detailed explanations.

View Full AI-103 Practice Test →

← Back to AI-103 Study Guide