AI-102 Plan and manage an Azure AI solution Practice Question
A healthcare company is using Azure AI Document Intelligence to extract patient data from forms. They need to ensure that all extracted data is encrypted at rest using a customer-managed key (CMK) and that the service endpoint is restricted to a specific virtual network. Which combination of steps should they take?
⚠ Common exam trap
Candidates often confuse 'service endpoint' or 'IP firewall rules' with 'private endpoint' for VNet-specific access, but only a private endpoint provides a fully private IP within the VNet and meets the 'restricted to a specific virtual network' requirement, while the other options either allow public exposure or do not enforce VNet-level isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private endpoint and associate a customer-managed key in the resource encryption settings
It combines a private endpoint (which restricts the service endpoint to a specific virtual network by providing a private IP address within that VNet, eliminating public internet exposure) with a customer-managed key (CMK) in the resource encryption settings, which ensures data at rest is encrypted using a key stored in Azure Key Vault that the customer controls. This directly meets both requirements: network isolation via private endpoint and CMK-based encryption at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a service endpoint and configure a managed identity
Why it's wrong here
Service endpoints do not support CMK encryption.
- ✗
Disable public network access and enable CMK via Azure Key Vault
Why it's wrong here
Disabling public network access alone does not enable CMK; must create private endpoint.
- ✗
Configure IP firewall rules and enable CMK via Azure Key Vault
Why it's wrong here
Firewall rules do not provide network isolation for CMK.
- ✓
Create a private endpoint and associate a customer-managed key in the resource encryption settings
Why this is correct
A private endpoint restricts the Document Intelligence endpoint to a specific virtual network, while associating a customer-managed key in the resource's encryption settings enforces CMK encryption at rest. Together these satisfy both the network isolation and key management constraints in the stem.
Go deeper
Related to this question
About these practice questions
One of 761 original AI-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.