Implement natural language processing solutions →hardMultiple Choice

AI-102 Practice Question: Implement natural language processing solutions

Exhibit

Refer to the exhibit.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.CognitiveServices/accounts",
      "apiVersion": "2023-05-01",
      "name": "myLanguageService",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "S"
      },
      "kind": "TextAnalytics",
      "properties": {
        "customSubDomainName": "mylanguageservice",
        "networkAcls": {
          "defaultAction": "Deny"
        }
      }
    }
  ]
}

You deploy the ARM template shown in the exhibit. After deployment, you need to allow access to the Language service from your on-premises application. What should you do?

⚠ Common exam trap

Many candidates confuse the 'defaultAction' property with a simple on/off switch for public access, not realizing that IP rules are evaluated first and can selectively permit traffic even when defaultAction is Deny.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add an IP rule with your on-premises public IP address.

The ARM template deploys an Azure Cognitive Services Language service with a network ACL that defaults to denying all traffic (defaultAction: Deny). To allow your on-premises application to access the service, you must add an IP rule that permits traffic from your on-premises public IP address. This is because the network ACL evaluates IP rules before the default action, and adding a rule with your public IP overrides the default deny for that specific source.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Add an IP rule with your on-premises public IP address.
Why this is correct
The deployed Language resource uses network restrictions, so on-premises traffic must be explicitly permitted. Adding a network rule containing the on-premises public IP address allows that origin through the firewall while keeping other public access blocked.
✗
Remove the customSubDomainName property.
Why it's wrong here
Removing customSubDomainName does not alter network ACL evaluation, so the on-premises application remains blocked. It is tempting because the custom subdomain relates to endpoint naming, and it would be correct when a token or endpoint URL fails due to an incorrect subdomain, not a firewall rule.
✗
Set the defaultAction to Allow.
Why it's wrong here
Setting defaultAction to Allow opens the firewall to all networks, defeating the network ACL restriction the template applies; the on-premises address range must instead be added to the allowed list. It is tempting because it does grant access, and it would be correct only when the resource should be reachable from every network.
✗
Change the SKU to F0 to allow public access.
Why it's wrong here
The F0 free tier still enforces the same network ACL rules, so changing SKU does not grant the on-premises application access. It is tempting because F0 is associated with public endpoints, and it would be correct when testing with a free-tier key rather than resolving connectivity.

Visual reference

Go deeper

AI-102 Practice Question: Implement natural language processing solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question