A multi-agent platform in a regulated tenant must ensure model endpoints, vector stores, and tool backends are not reachable from the public internet, while agents still call them securely from Azure. Which design best matches Zero Trust network boundaries?
Select an answer to reveal the explanation.
Short Explanation
Correct answer: B. Zero Trust for multi-agent platforms means private endpoints/VNet integration, disabled public access where required, and identity on every call—network isolation plus auth. Public anonymous exposure (A), secret URLs (C), and wide-open ports (D) fail regulated designs. Agents use private connectivity and managed identities; never treat the network alone as sufficient.
Full Explanation
Resource access design includes network boundaries, access control policies, and RBAC/identity. Option B combines private connectivity with identity-based authentication—defense in depth. Option A maximizes exposure. Option C is security through obscurity. Option D expands attack surface. Validate that tool backends, Foundry/model endpoints, and vector stores comply with private link patterns, and monitor for accidental public enablement via policy.