A multi-agent system in Azure must call internal finance APIs that must not be reachable from the public internet. Agents run in Foundry-connected compute inside a virtual network. Which network design best enforces this boundary?
Select an answer to reveal the explanation.
Short Explanation
The correct answer is C. Keep finance APIs off the public internet with private endpoints or internal LBs, constrain agent egress, and deny public inbound. Security-by-obscure-URL fails. Dumping the database to a public blob destroys the boundary. Disabling TLS is never the answer.
Full Explanation
Option C is correct. Resource access design for multi-agent solutions includes network boundaries alongside identity controls. Private endpoints/internal entry points plus egress restriction keep tool traffic on private paths and block public inbound exposure of finance APIs.
Option A is incorrect because obscure public URLs are not access control and will be discovered or scanned.
Option B is incorrect because copying finance data to public storage expands exposure rather than enforcing network boundaries.
Option D is incorrect because disabling TLS weakens confidentiality and integrity and is incompatible with secure enterprise design.