AI-200 Security And Observability Practice Question
You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Private Link with a private endpoint for the Azure OpenAI resource
Configuring private endpoints via Azure Private Link allows secure access from a peered virtual network using a private IP address from the VNet's address space, while public network access can be completely disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service endpoints with default deny rules on the public firewall
Why it's wrong here
Incorrect. Service endpoints extend your VNet identity to the service, but private endpoints provide superior isolation by assigning a private IP and allowing total public access disabling.
- ✗
Azure Application Gateway with Web Application Firewall (WAF)
Why it's wrong here
Incorrect. Application Gateway sits in front of web apps, not directly securing PaaS service endpoints at the networking layer for private access.
- ✗
Azure Bastion deployed in the management subnet
Why it's wrong here
Incorrect. Azure Bastion is used for secure RDP/SSH connectivity to Azure virtual machines, not for securing PaaS cognitive services.
- ✓
Azure Private Link with a private endpoint for the Azure OpenAI resource
Why this is correct
Correct. Private endpoints securely map the service endpoint to a private IP within your VNet and allow you to disable public access.
About these practice questions
One of 507 original AI-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Microsoft exam blueprint
This AI-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-200 exam.