AI-102 Implement generative AI solutions Practice Question
You are deploying a generative AI model using Azure AI Foundry. The model must be accessible only from within a specific virtual network. Additionally, you need to monitor all API calls for auditing. Which two configurations are required? (Choose two.)
⚠ Common exam trap
Many candidates confuse network-level access controls (like IP whitelisting or CORS) with true VNet isolation via private endpoints, and they overlook that diagnostic settings are the standard Azure mechanism for auditing API calls, not managed identities or CORS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable diagnostic settings to send logs to a Log Analytics workspace.
Enabling diagnostic settings to send logs to a Log Analytics workspace allows you to capture and audit all API calls made to the model deployment. This is essential for monitoring, security auditing, and compliance, as it records detailed telemetry such as request timestamps, caller IPs, and operation names. Option E is correct because disabling public network access and configuring a private endpoint ensures that the model is only accessible from within the specified virtual network, meeting the isolation requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a managed identity to the model deployment.
Why it's wrong here
Managed identity is for authentication, not network restriction.
- ✗
Configure CORS to allow only the VNet's domain.
Why it's wrong here
CORS is for browser-based cross-origin requests, not VNet access.
- ✗
Enable public network access from selected IP addresses.
Why it's wrong here
This does not restrict to VNet.
- ✓
Enable diagnostic settings to send logs to a Log Analytics workspace.
Why this is correct
Logs enable auditing of all API calls.
- ✓
Disable public network access and configure a private endpoint.
Why this is correct
Private endpoint ensures VNet-only access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AI-102 question from scratch — 945 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.