Implement generative AI solutions →mediumMultiple ChoiceObjective-mapped

AI-102 Implement generative AI solutions Practice Question

Exhibit

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "cognitiveServiceName": {
      "value": "my-ai-service"
    },
    "location": {
      "value": "eastus"
    },
    "sku": {
      "value": "S0"
    },
    "customSubDomainName": {
      "value": "my-ai-service"
    },
    "networkAcls": {
      "value": {
        "defaultAction": "Deny",
        "virtualNetworkRules": [],
        "ipRules": []
      }
    }
  }
}

Refer to the exhibit. You are deploying an Azure AI Services resource using an ARM template. After deployment, you cannot access the resource from any client, including the Azure portal. What is the most likely cause?

⚠ Common exam trap

Test-takers frequently assume an empty virtualNetworkRules array means no restrictions, but the defaultAction property controls the default behavior, and setting it to Deny with no allow rules blocks all traffic regardless of empty arrays.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The networkAcls defaultAction is set to Deny with no allowed IP or virtual network rules.

The networkAcls defaultAction set to Deny with no allowed IP or virtual network rules blocks all traffic to the Azure AI Services resource, including requests from the Azure portal and any client. This is because the default network access control list (ACL) denies all traffic unless explicitly permitted by IP rules or virtual network rules, rendering the resource inaccessible even for management operations.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The SKU S0 does not support network restrictions.
Why it's wrong here
S0 supports network ACLs.
✗
The cognitiveServiceName conflicts with an existing resource.
Why it's wrong here
Would cause deployment error, not access issue.
✓
The networkAcls defaultAction is set to Deny with no allowed IP or virtual network rules.
Why this is correct
Blocks all traffic, including portal.
✗
The virtualNetworkRules array is empty.
Why it's wrong here
Empty array means no allowed VNets.

Visual reference

Go deeper

AI-102 Implement generative AI solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question