Plan and manage an Azure AI solution →mediumMultiple Choice

AI-102 Plan and manage an Azure AI solution Practice Question

You are deploying an Azure AI solution that calls Azure OpenAI and Azure AI Language from an Azure Container Apps environment. The solution must authenticate to both services without using service keys, and the container app must be able to access the services even if the network is restricted to private endpoints. What should you configure?

⚠ Common exam trap

The trap here is assigning a management-plane role such as Contributor and expecting it to authorize data-plane inference calls, which require a Cognitive Services data role instead.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable a system-assigned managed identity on the container app and assign the Cognitive Services User role to the identity on each Azure AI resource.

Identity-based authentication with a managed identity and the Cognitive Services User role allows the container app to call Azure OpenAI and Azure AI Language without any keys. Because the identity is recognized by Microsoft Entra ID, the calls are authorized even when the services are reachable only through private endpoints. The other options either use keys or assign roles that do not grant data-plane access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a service principal, store its client secret in the container app environment variables, and assign the Contributor role on each Azure AI resource.
Why it's wrong here
A service principal secret is a credential that must be rotated and protected, which violates the requirement to avoid keys. The Contributor role is a management-plane role and does not grant data-plane access to call Azure OpenAI or Azure AI Language inference endpoints. This approach also does not solve private endpoint access.
✗
Use the Azure AI services multi-service account key retrieved from Azure Key Vault and pass it in the Ocp-Apim-Subscription-Key header.
Why it's wrong here
Retrieving a key from Key Vault still uses a service key for authentication, which the scenario explicitly forbids. The multi-service key also does not apply uniformly to Azure OpenAI deployments, which use their own endpoint and key or identity-based authorization. This option does not meet the requirement to authenticate without service keys.
✗
Configure the container app to use an Azure Front Door origin with a private link and enable token-based authentication by using a shared access signature.
Why it's wrong here
Azure Front Door and shared access signatures are not authentication mechanisms for Azure OpenAI or Azure AI Language data-plane calls. A shared access signature is used for Azure Storage, not for these AI services, and Front Door does not provide the identity needed to authorize inference requests. This option confuses networking with authentication.
✓
Enable a system-assigned managed identity on the container app and assign the Cognitive Services User role to the identity on each Azure AI resource.
Why this is correct
A system-assigned managed identity gives the container app an identity in Microsoft Entra ID without any secret. Assigning the Cognitive Services User role on each Azure AI resource grants the data-plane permissions needed to call Azure OpenAI and Azure AI Language. This works with private endpoints because authentication uses the identity rather than keys.

Go deeper

AI-102 Plan and manage an Azure AI solution Practice Question

Why each option matters

Option-by-option breakdown

Related to this question