AI-102 Implement generative AI solutions Practice Question
You are deploying a generative AI model using Azure AI Foundry. The model must be accessible only from within a specific virtual network. Additionally, you need to monitor all API calls for auditing. Which two configurations are required? (Choose two.)
⚠ Common exam trap
Many candidates confuse network-level access controls (like IP whitelisting or CORS) with true VNet isolation via private endpoints, and they overlook that diagnostic settings are the standard Azure mechanism for auditing API calls, not managed identities or CORS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable diagnostic settings to send logs to a Log Analytics workspace.
Enabling diagnostic settings to send logs to a Log Analytics workspace allows you to capture and audit all API calls made to the model deployment. This is essential for monitoring, security auditing, and compliance, as it records detailed telemetry such as request timestamps, caller IPs, and operation names. Option E is correct because disabling public network access and configuring a private endpoint ensures that the model is only accessible from within the specified virtual network, meeting the isolation requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a managed identity to the model deployment.
Why it's wrong here
A managed identity lets the deployment authenticate to other Azure resources without stored credentials; it neither confines inbound access to a virtual network nor records API calls for auditing. It is tempting because managed identities are genuinely required when the model must securely access Key Vault or Storage.
- ✗
Configure CORS to allow only the VNet's domain.
Why it's wrong here
CORS governs which browser origins may call the endpoint; it does not restrict network-level access to a virtual network, nor does it log API calls. It is tempting because CORS is legitimately configured when web apps on other domains must invoke an API from client-side JavaScript.
- ✗
Enable public network access from selected IP addresses.
Why it's wrong here
Allowing selected public IP addresses still exposes the model endpoint over the internet, so access is not restricted to the virtual network as the scenario demands. It is tempting because this setting is genuinely used when clients outside Azure must reach the service over public endpoints.
- ✓
Enable diagnostic settings to send logs to a Log Analytics workspace.
Why this is correct
Diagnostic settings stream control-plane and data-plane request logs from the Azure AI Foundry resource to a Log Analytics workspace, satisfying the auditing requirement for all API calls. This directly addresses the stem's monitoring constraint, complementing the private endpoint needed for virtual network isolation.
- ✓
Disable public network access and configure a private endpoint.
Why this is correct
Disabling public network access and configuring a private endpoint forces all traffic through the virtual network via a private IP address, satisfying the requirement that the model be reachable only from within the specified VNet. This removes exposure to the public internet, which the stem's network isolation constraint demands.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AI-102 question from scratch — 761 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.