Plan and manage an Azure AI solution →mediumMultiple ChoiceObjective-mapped

AI-102 Plan and manage an Azure AI solution Practice Question

Exhibit

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.CognitiveServices/accounts",
      "apiVersion": "2023-05-01",
      "name": "myaiservices",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "S0"
      },
      "kind": "AIServices",
      "properties": {
        "customSubDomainName": "myaiservices",
        "networkAcls": {
          "defaultAction": "Deny"
        }
      }
    }
  ]
}

Refer to the exhibit. You deploy an Azure AI Services multi-service account using this ARM template. After deployment, developers cannot access the service from their local machines. What is the most likely reason?

⚠ Common exam trap

Microsoft often tests the misconception that network ACLs only affect virtual network traffic or that they are optional by default, when in fact setting `defaultAction: Deny` explicitly blocks all traffic unless allow rules are configured.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The network ACLs block all traffic by default

The ARM template for an Azure AI Services multi-service account includes a `networkAcls` property with `defaultAction` set to `Deny`. This configuration blocks all traffic by default, including requests from developers' local machines, unless an explicit IP rule or virtual network rule is added to allow access. Since no such rules are shown in the exhibit, the network ACLs are the most likely cause of the connectivity failure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The location is not specified correctly
Why it's wrong here
Location is inherited from resource group; it does not block access.
✗
The pricing tier S0 does not support network restrictions
Why it's wrong here
S0 tier supports network ACLs; the issue is the deny rule itself.
✗
The custom subdomain name is not globally unique
Why it's wrong here
Uniqueness affects endpoint resolution but not access once created.
✓
The network ACLs block all traffic by default
Why this is correct
'defaultAction': 'Deny' blocks all traffic unless explicitly allowed via IP rules or virtual networks.

Go deeper

AI-102 Plan and manage an Azure AI solution Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question