A regulated enterprise requires that multi-agent workloads in Azure cannot reach the public internet for tool APIs hosted on Azure App Service and Azure OpenAI. Agents still need private connectivity to those endpoints and to Key Vault. Which network design best meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
Correct answer: C. Network isolation is the fence around the farm: VNet integration plus private endpoints for OpenAI, tools, and Key Vault means agent traffic stays on private rails. Prompt text saying “please don’t use the internet” is not a control plane.
Full Explanation
Secure multi-agent deployments must specify network boundaries along with identity controls. Option C is correct: VNet-integrated agent compute with private endpoints/private link to Azure OpenAI, App Service–hosted tools, and Key Vault enforces private connectivity and reduces public exposure, aligning with Zero Trust network design for regulated workloads.
Option A is incorrect: public compute with only API keys provides no network boundary and increases attack surface.
Option B is incorrect: unrestricted egress plus prompt-only restrictions is not enforceable network isolation.
Option D is incorrect: public tools with a wide-open allowlist defeat isolation goals.
Exam tip: Pair identity least privilege with network isolation (VNet + private endpoints) when scenarios mention regulated or no-public-internet requirements.