Plan and manage an Azure AI solution →mediumMultiple ChoiceObjective-mapped

AI-102 Plan and manage an Azure AI solution Practice Question

Exhibit

{
  "resource": {
    "type": "Microsoft.CognitiveServices/accounts",
    "name": "myaiservice",
    "kind": "CognitiveServices",
    "sku": {
      "name": "S0"
    },
    "properties": {
      "customSubDomainName": "myaiservice",
      "networkAcls": {
        "defaultAction": "Deny",
        "virtualNetworkRules": [
          {
            "id": "/subscriptions/.../virtualNetworks/myVNet/subnets/default",
            "action": "Allow"
          }
        ],
        "ipRules": []
      }
    }
  }
}

Refer to the exhibit. You deployed this Azure AI Service resource. Developers report that they cannot call the service from their local machines using the API endpoint. The developers are not connected to the corporate VPN. What should you do?

⚠ Common exam trap

A common mix-up: candidates confuse 'virtual network rules' with 'IP rules', assuming that adding a virtual network rule for the developers' subnet will work even when the developers are not connected to that subnet, but virtual network rules require the client to be within the specified VNet's IP space, which is not the case for local machines without VPN.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add the developers' public IP addresses to the ipRules list.

The exhibit shows that the Azure AI Service resource's network configuration has 'Selected Networks and Private Endpoints' enabled with a defaultAction of 'Deny'. This means only traffic from explicitly allowed IP addresses or virtual networks can reach the endpoint. Since the developers are not on the corporate VPN, they cannot use a virtual network rule. The correct solution is to add their public IP addresses to the ipRules list, which explicitly permits traffic from those specific IPs while keeping the default deny for all other traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Disable network ACLs entirely.
Why it's wrong here
Unnecessary; selective IP allow is better.
✓
Add the developers' public IP addresses to the ipRules list.
Why this is correct
Allows access from specific public IPs while keeping VNet rule.
✗
Change defaultAction to Allow and remove all rules.
Why it's wrong here
Removes network security, which may not be desired.
✗
Add a second virtual network rule for the developers' subnet.
Why it's wrong here
Developers are not on any VNet; a VNet rule won't help.

Visual reference

Go deeper

AI-102 Plan and manage an Azure AI solution Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question