AI-102 Plan and manage an Azure AI solution Practice Question
A healthcare organization is deploying an Azure AI Document Intelligence solution to extract medical record data. The solution must comply with HIPAA and process sensitive patient data. The data must be encrypted at rest and in transit, and access must be audited. The solution will be used by multiple departments, each requiring different levels of access. Which combination of Azure services should the architect recommend?
⚠ Common exam trap
Many exam-takers choose a public endpoint with Azure AD authentication (Option A or B) thinking it is secure enough, but HIPAA requires network-level isolation (private endpoints) for protected health information, not just authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure AI Document Intelligence with private endpoints, managed identity authentication, Azure Storage with customer-managed keys (CMK), and Azure RBAC for access control.
It ensures HIPAA compliance by using private endpoints to keep traffic within the Azure backbone network, managed identity for secure authentication without storing credentials, customer-managed keys (CMK) for encryption at rest with full control over key rotation, and Azure RBAC to enforce least-privilege access across departments. This combination addresses encryption in transit (private endpoint + HTTPS), encryption at rest (CMK), and audited access (RBAC + Azure Monitor).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure AI Document Intelligence with public endpoint, Azure AD authentication, and Azure Storage with customer-managed keys (CMK).
Why it's wrong here
Public endpoint exposes the service to the internet; private endpoints are required for HIPAA compliance.
- ✗
Azure AI Document Intelligence with public endpoint, Azure AD authentication, and Azure Storage with encryption at rest using Microsoft-managed keys.
Why it's wrong here
Public endpoint is not secure for sensitive data; lacks private connectivity.
- ✓
Azure AI Document Intelligence with private endpoints, managed identity authentication, Azure Storage with customer-managed keys (CMK), and Azure RBAC for access control.
Why this is correct
Private endpoints secure data in transit, managed identities avoid keys, CMK provides encryption control, and RBAC enables granular access.
- ✗
Azure AI Document Intelligence with service endpoints, shared access signature (SAS) tokens, and Azure Storage with encryption at rest using Microsoft-managed keys.
Why it's wrong here
SAS tokens are less secure than managed identities and service endpoints do not provide the same level of isolation as private endpoints.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 945 original AI-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.