Azure AI Foundry Private Endpoint and Diagnostic Logs
You are deploying a generative AI model using Azure AI Foundry. The model must be accessible only from a specific virtual network. Additionally, you need to monitor all API calls for auditing. Which two configurations are required? (Choose two.)
Quick Answer
This scenario has two separate requirements that need two separate configurations, which is exactly why it's a choose-two question rather than a single answer. Restricting access to a specific virtual network is handled by disabling public network access on the Azure AI Foundry resource and configuring a private endpoint, which places the resource's network presence inside the VNet so it's only reachable from within it rather than over the public internet — that's an access-control setting, and it does nothing on its own to produce an audit trail. Monitoring every API call is a completely separate concern, handled by enabling diagnostic settings and routing the logs to a Log Analytics workspace, which captures request-level detail like the request URI, response status, and caller IP for every call made against the resource. Neither configuration substitutes for the other: a private endpoint controls who can reach the resource but doesn't log what they did once connected, and diagnostic logging records activity but doesn't restrict where that activity can originate from. Any scenario combining a network-access restriction with an auditing or monitoring requirement is asking for both a private endpoint (or equivalent network control) and diagnostic settings configured together, not either alone.
⚠ Common exam trap
Watch out — candidates often confuse network access controls (private endpoints) with authentication mechanisms (managed identities) or browser-level restrictions (CORS), leading them to select B or E instead of the correct pairing of D and A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable diagnostic settings to send logs to a Log Analytics workspace.
Enabling diagnostic settings to send logs to a Log Analytics workspace captures all API call details (e.g., request URI, response status, caller IP) for auditing and monitoring. This is the standard Azure method for collecting resource-level logs, and it works with Azure AI Foundry deployments to meet compliance and security requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable diagnostic settings to send logs to a Log Analytics workspace.
Why this is correct
Logs enable auditing of all API calls.
- ✗
Assign a managed identity to the model deployment.
Why it's wrong here
Managed identity is for authentication, not network restriction.
- ✗
Enable public network access from selected IP addresses.
Why it's wrong here
This does not restrict to VNet.
- ✓
Disable public network access and configure a private endpoint.
Why this is correct
Private endpoint ensures VNet-only access.
- ✗
Configure CORS to allow only the VNet's domain.
Why it's wrong here
CORS is for browser-based cross-origin requests, not VNet access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AI-102 question from scratch — 945 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AI-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are deploying a generative AI model using Azure AI Foundry. The model must be accessible only from within a specific virtual network. Additionally, you need to monitor all API calls for auditing. Which two configurations are required? (Choose two.)
hard- A.Assign a managed identity to the model deployment.
- B.Configure CORS to allow only the VNet's domain.
- C.Enable public network access from selected IP addresses.
- ✓ D.Enable diagnostic settings to send logs to a Log Analytics workspace.
- ✓ E.Disable public network access and configure a private endpoint.
Why D: Enabling diagnostic settings to send logs to a Log Analytics workspace allows you to capture and audit all API calls made to the model deployment. This is essential for monitoring, security auditing, and compliance, as it records detailed telemetry such as request timestamps, caller IPs, and operation names. Option E is correct because disabling public network access and configuring a private endpoint ensures that the model is only accessible from within the specified virtual network, meeting the isolation requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.