How Do You Restrict Azure Language Resource ta1 to vnet1?
You have an Azure subscription that contains an Azure Language in Foundry Tools service resource named ta1 and a virtual network named vnet1. You need to ensure that only resources in vnet1 can access ta1. What should you configure?
Community Insight
The question tests where Azure AI service network isolation is enforced: on the Language resource's networking settings, while the trap is assuming an NSG or firewall on vnet1 can authorize the service.
Azure Language in Foundry Tools restricts inbound access by configuring the resource's own virtual network settings, not by filtering vnet1 traffic with an NSG or Azure Firewall. The page confirms that ta1 must be scoped to vnet1 through its Networking / Selected networks and private endpoints configuration.
Learners often pick an NSG for vnet1, but NSGs filter traffic between subnets and hosts and cannot define which virtual networks an Azure Language resource accepts.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure Language in Foundry Tools, like other Azure AI services, exposes inbound network restrictions on the resource itself. To ensure that only resources in vnet1 can reach ta1, you configure ta1's virtual network settings, typically by choosing Selected networks and private endpoints, then linking vnet1 through a service endpoint or private endpoint. This makes the service-side allow-list authoritative for ta1 rather than relying on traffic filtering elsewhere in the network. Option D matches that control surface exactly.Why the Other Options Are Wrong
An NSG for vnet1 filters packets at subnets or NICs inside vnet1, but it does not tell ta1 which virtual networks may access it, so it cannot satisfy the requirement on its own. A Language service container for ta1 runs the service in a container environment and does not configure the cloud resource's inbound virtual network rules. Azure Firewall for vnet1 inspects outbound or east-west traffic but is not the mechanism that authorizes vnet1 to call ta1. None of these alternatives changes ta1's networking policy, which is the decisive control in this scenario.Community Comment Notes
A visible learner comment from Srikantha supports D and explains that the setting lives on ta1 under Networking, using Selected Networks and Private Endpoints. The same comment states that you must configure "the Networking / Virtual network settings on ta1 itself" to link vnet1 through service endpoints or a private endpoint. That aligns with the service-side isolation model tested here. No visible comment presents a credible argument for the NSG, container, or Azure Firewall options.Official Reference
Exam Strategy
For any “only resources in vnetX can access serviceY” scenario, identify the resource that exposes the networking control; Azure AI and Language services use their own virtual network settings, often paired with private endpoints. Do not substitute subnet-level NSGs or Azure Firewall for service-level authorization.
Frequently Asked Questions
Why can't an NSG on vnet1 restrict ta1 to only vnet1?
An NSG filters packets at subnets or NICs in vnet1 but does not define which virtual networks the Azure Language resource accepts; that allow-list is set on ta1's networking settings.
Does the Language service container option provide the same vnet restriction for ta1?
No. A Language container runs the service locally in a container and does not configure the cloud ta1 resource's inbound virtual network rules.
Related Analysis
Practice All AI-103 Questions
Access 88 questions with complete answers and detailed explanations.
View Full AI-103 Practice Test →