Plan and manage an Azure AI solution →hardMultiple ChoiceObjective-mapped

AI-102 Plan and manage an Azure AI solution Practice Question

Exhibit

Refer to the exhibit.
{
  "name": "AIHub-HR",
  "location": "eastus",
  "properties": {
    "storageAccount": "/subscriptions/abc/resourceGroups/rg-ai/providers/Microsoft.Storage/storageAccounts/staihub",
    "keyVault": "/subscriptions/abc/resourceGroups/rg-ai/providers/Microsoft.KeyVault/vaults/kvaihub",
    "applicationInsights": "/subscriptions/abc/resourceGroups/rg-ai/providers/microsoft.insights/components/appinsights-aihub",
    "containerRegistry": "/subscriptions/abc/resourceGroups/rg-ai/providers/Microsoft.ContainerRegistry/registries/acrai"
  }
}

You are reviewing the ARM template snippet for an Azure AI Foundry hub. After deployment, you notice that the hub cannot connect to the storage account. What is the most likely cause?

⚠ Common exam trap

Many exam-takers assume connectivity issues are due to resource naming or regional availability, when the real cause is the managed network's default outbound blocking behavior, which is a common security feature in Azure AI services.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The hub uses a managed network that blocks outbound traffic to the storage account

The most likely cause is that the hub uses a managed network which, by default, blocks outbound traffic to the storage account unless explicitly allowed via outbound rules or private endpoints. Azure AI Foundry hubs enforce network isolation for security, and if the storage account is not configured as an approved destination, the hub cannot establish the required connections for data access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The hub uses a managed network that blocks outbound traffic to the storage account
Why this is correct
Managed networks can block access to resources without proper firewall rules.
✗
The location 'eastus' does not support AI Foundry hubs
Why it's wrong here
eastus supports AI Foundry hubs.
✗
The storage account name contains invalid characters
Why it's wrong here
The name 'staihub' is valid.
✗
The key vault is not configured with a firewall rule
Why it's wrong here
The key vault is not directly involved in the storage connection.

Go deeper

AI-102 Plan and manage an Azure AI solution Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question