A multi-agent platform in a regulated tenant must ensure model endpoints, vector stores, and tool backends are not reachable from the public internet, while agents still call them securely from Azure. Which design best matches Zero Trust network boundaries?
Select an answer to reveal the explanation.
Short Explanation
You need private endpoints and VNet integration, with public access restricted and identity-based auth on every call. That gives you network isolation plus Zero Trust identity checks. Public anonymous access, secret URLs, and wide-open ports don't cut it.
Full Explanation
Resource access design includes network boundaries, access control policies, and RBAC/identity. The private endpoints and VNet integration design combines private connectivity with identity-based authentication, giving you defense in depth. The public anonymous access design maximizes exposure. The long complex URL path design is security through obscurity. The wide-open inbound ports design expands the attack surface. Validate that tool backends, Foundry/model endpoints, and vector stores comply with private link patterns, and monitor for accidental public enablement via policy. Agents should use private connectivity and managed identities, and you should never treat the network alone as sufficient.