AI-102 Plan and manage an Azure AI solution Practice Question
A healthcare company is using Azure AI Document Intelligence to extract patient data from forms. They need to ensure that all extracted data is encrypted at rest using a customer-managed key (CMK) and that the service endpoint is restricted to a specific virtual network. Which combination of steps should they take?
⚠ Common exam trap
Candidates often confuse 'service endpoint' or 'IP firewall rules' with 'private endpoint' for VNet-specific access, but only a private endpoint provides a fully private IP within the VNet and meets the 'restricted to a specific virtual network' requirement, while the other options either allow public exposure or do not enforce VNet-level isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private endpoint and associate a customer-managed key in the resource encryption settings
It combines a private endpoint (which restricts the service endpoint to a specific virtual network by providing a private IP address within that VNet, eliminating public internet exposure) with a customer-managed key (CMK) in the resource encryption settings, which ensures data at rest is encrypted using a key stored in Azure Key Vault that the customer controls. This directly meets both requirements: network isolation via private endpoint and CMK-based encryption at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a service endpoint and configure a managed identity
Why it's wrong here
Service endpoints do not support CMK encryption.
- ✗
Disable public network access and enable CMK via Azure Key Vault
Why it's wrong here
Disabling public network access alone does not enable CMK; must create private endpoint.
- ✗
Configure IP firewall rules and enable CMK via Azure Key Vault
Why it's wrong here
Firewall rules do not provide network isolation for CMK.
- ✓
Create a private endpoint and associate a customer-managed key in the resource encryption settings
Why this is correct
Private endpoint secures network traffic; CMK encryption is configured in resource settings with Key Vault.
Go deeper
Related to this question
About these practice questions
One of 945 original AI-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.