Implement generative AI solutions →mediumMultiple Choice

AI-102 Implement generative AI solutions Practice Question

Exhibit

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "cognitiveServiceName": {
      "value": "my-ai-service"
    },
    "location": {
      "value": "eastus"
    },
    "sku": {
      "value": "S0"
    },
    "customSubDomainName": {
      "value": "my-ai-service"
    },
    "networkAcls": {
      "value": {
        "defaultAction": "Deny",
        "virtualNetworkRules": [],
        "ipRules": []
      }
    }
  }
}

Refer to the exhibit. You are deploying an Azure AI Services resource using an ARM template. After deployment, you cannot access the resource from any client, including the Azure portal. What is the most likely cause?

⚠ Common exam trap

Test-takers frequently assume an empty virtualNetworkRules array means no restrictions, but the defaultAction property controls the default behavior, and setting it to Deny with no allow rules blocks all traffic regardless of empty arrays.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The networkAcls defaultAction is set to Deny with no allowed IP or virtual network rules.

The networkAcls defaultAction set to Deny with no allowed IP or virtual network rules blocks all traffic to the Azure AI Services resource, including requests from the Azure portal and any client. This is because the default network access control list (ACL) denies all traffic unless explicitly permitted by IP rules or virtual network rules, rendering the resource inaccessible even for management operations.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The SKU S0 does not support network restrictions.
Why it's wrong here
S0 supports network restrictions, so the SKU is not the blocker; the actual cause lies in the template's network configuration. It is tempting because lower SKUs on some Azure services lack virtual network integration, but for Azure AI Services, S0 is the tier that enables private endpoints and firewall rules.
✗
The cognitiveServiceName conflicts with an existing resource.
Why it's wrong here
A name conflict would fail the ARM deployment outright, yet the stem states deployment succeeded and the resource exists but is unreachable. It is tempting because naming collisions are a common ARM error, but they surface as deployment failures, not post-deployment connectivity problems.
✓
The networkAcls defaultAction is set to Deny with no allowed IP or virtual network rules.
Why this is correct
Setting networkAcls defaultAction to Deny without any allow rules blocks all traffic, including the Azure portal, since no IP or subnet is permitted. This explains why every client fails to reach the Azure AI Services resource after deployment.
✗
The virtualNetworkRules array is empty.
Why it's wrong here
An empty virtualNetworkRules array means no subnet restrictions are applied, which permits access rather than blocking it. It is tempting because virtual network rules govern network access, but an empty array is the permissive default; a populated array with a mismatched subnet would deny traffic.

Visual reference

Go deeper

AI-102 Implement generative AI solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question