Foundry & Networking — AI-103 Practice Question
A representative Microsoft Azure AI Apps and Agents Developer Associate (AI-103) exam question on Foundry & Networking. Work through it below, then read why each option is right or wrong.
This question is part of the free Microsoft Azure AI Apps and Agents Developer Associate practice test.
Short answer
The correct answer is A. Configure private endpoints for the Foundry hub and its dependent resources, and deploy the hub with managed network isolation set to require approval.
Private endpoints combined with managed network isolation (configured to require approval for outbound connections) ensure all traffic between the Foundry hub, its dependent resources (Azure OpenAI, AI Search, storage, Key Vault), and the portal stays on the Microsoft backbone network rather than the public internet. Conditional Access controls who can sign in based on identity/location but does not stop data-plane traffic from traversing the public internet. Resource locks only prevent deletion or modification of the resource, unrelated to network isolation. Disabling public access on only the storage account leaves the Azure OpenAI and Search resources exposed, failing the stated requirement that no traffic to those resources traverse the internet.
The Question
A financial services team is provisioning a Microsoft Foundry hub for a new fraud-detection project. Regulatory policy requires that no traffic to the Azure OpenAI and Azure AI Search resources ever traverse the public internet, including from the Foundry portal used by data scientists. Which configuration best satisfies this requirement?
Why A is correct
Private endpoints combined with managed network isolation (configured to require approval for outbound connections) ensure all traffic between the Foundry hub, its dependent resources (Azure OpenAI, AI Search, storage, Key Vault), and the portal stays on the Microsoft backbone network rather than the public internet. Conditional Access controls who can sign in based on identity/location but does not stop data-plane traffic from traversing the public internet. Resource locks only prevent deletion or modification of the resource, unrelated to network isolation. Disabling public access on only the storage account leaves the Azure OpenAI and Search resources exposed, failing the stated requirement that no traffic to those resources traverse the internet.
Why the other options are wrong
Option B does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (A) is the only one that fully meets every constraint stated in the question.
Option C does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (A) is the only one that fully meets every constraint stated in the question.
Option D does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (A) is the only one that fully meets every constraint stated in the question.
Key idea: Foundry & Networking
Private endpoints combined with managed network isolation (configured to require approval for outbound connections) ensure all traffic between the Foundry hub, its dependent resources (Azure OpenAI, AI Search, storage, Key Vault), and the portal stays on the Microsoft backbone network rather than the public internet. Conditional Access controls who can sign in based on identity/location but does not stop data-plane traffic from traversing the public internet. Resource locks only prevent deletion or modification of the resource, unrelated to network isolation. Disabling public access on only the storage account leaves the Azure OpenAI and Search resources exposed, failing the stated requirement that no traffic to those resources traverse the internet. On the AI-103 exam, questions in the "Plan and manage an Azure AI solution" domain test whether you can map a scenario's constraints to the right choice. Read the requirement carefully, eliminate options that violate any single constraint, and pick the one that satisfies all of them with the least operational overhead.
Ready to see how you'd score?
Take the free practice quiz and find out which Microsoft Azure AI Apps and Agents Developer Associate domains you need to focus on. No signup required.
Practice 5 similar questions
Same cert, same or adjacent domain. Use these after reviewing the explanation.
Related Microsoft Azure AI Apps and Agents Developer Associate Practice Questions
Official sources used
Verify program and exam details at the source before scheduling.