Plan and manage an Azure AI solution →mediumMultiple Choice

AI-102 Plan and manage an Azure AI solution Practice Question

Exhibit

resourceGroupName = 'rg-ai-dev'
sku = 'S0'
kind = 'TextAnalytics'
location = 'eastus'

# Deploy Azure AI Language resource
resource 'Microsoft.CognitiveServices/accounts' 'textAnalytics' = {
  name: 'myTextAnalytics'
  location: location
  sku: {
    name: sku
  }
  kind: kind
  properties: {
    customSubDomainName: 'mytextanalytics'
  }
}

Refer to the exhibit. You are reviewing a Bicep template for deploying an Azure AI Language resource. After deployment, you need to ensure that the resource uses a private endpoint to block public access. Which additional resource should you include in the template?

⚠ Common exam trap

Watch out — candidates often confuse service endpoints (which only filter source traffic but leave the public endpoint active) with private endpoints (which completely remove public accessibility), leading them to incorrectly select Option A.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A Private Endpoint resource linked to the Cognitive Services account

A Private Endpoint resource, when linked to the Cognitive Services account via the `privateLinkServiceId` property, assigns a private IP address from a virtual network to the Azure AI Language resource. This blocks all public access by default when the resource's `publicNetworkAccess` property is set to 'Disabled', ensuring traffic only flows over the Microsoft backbone network through Azure Private Link.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A service endpoint for Microsoft.CognitiveServices
Why it's wrong here
A service endpoint extends the virtual network's identity to the Microsoft.CognitiveServices service over the Azure backbone, yet the resource keeps its public IP and remains reachable from the internet. It is tempting because service endpoints restrict access to chosen subnets, and would be correct when public endpoints must stay enabled.
✗
A virtual network peering connection
Why it's wrong here
Virtual network peering links two virtual networks so traffic flows between them, but it neither provisions a private endpoint nor removes the resource's public endpoint. It is tempting because peering is required when clients in another virtual network must reach a private endpoint, and would be correct once that endpoint already exists.
✗
A virtual network gateway
Why it's wrong here
A virtual network gateway provides VPN or ExpressRoute connectivity into a virtual network; it does not create the private endpoint interface that gives the Azure AI Language resource a private IP and disables public access. It is tempting because gateways secure hybrid connectivity, and would be correct when connecting on-premises networks to Azure.
✓
A Private Endpoint resource linked to the Cognitive Services account
Why this is correct
A Private Endpoint resource creates a private IP address within your virtual network and connects it to the Cognitive Services account via a private link, removing public exposure. This satisfies the requirement to block public access after deployment.

Go deeper

AI-102 Plan and manage an Azure AI solution Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question