A multi-agent system in Azure must call internal finance APIs that must not be reachable from the public internet. Agents run in Foundry-connected compute inside a virtual network. Which network design best enforces this boundary?
Select an answer to reveal the explanation.
Short Explanation
You keep finance APIs off the public internet with private endpoints or internal load balancers, constrain agent egress, and deny public inbound paths. Security-by-obscure-URL fails, dumping the database to a public blob destroys the boundary, and disabling TLS is never the answer.
Full Explanation
The private endpoint/internal load balancer design is correct. Resource access design for multi-agent solutions includes network boundaries alongside identity controls. Private endpoints/internal entry points plus egress restriction keep tool traffic on private paths and block public inbound exposure of finance APIs. The public IP with obscure URL paths approach is incorrect because obscure public URLs are not access control and will be discovered or scanned. The download entire database to public blob approach is incorrect because copying finance data to public storage expands exposure rather than enforcing network boundaries. The disable TLS approach is incorrect because disabling TLS weakens confidentiality and integrity and is incompatible with secure enterprise design.