A multi-agent solution in Azure calls internal knowledge indexes and MCP tools hosted on private APIs. Compliance forbids agent traffic to those backends over the public internet. Which control should you specify?
Select an answer to reveal the explanation.
Short Explanation
Answer A. Resource access design includes network boundaries plus identity-based access. Private endpoints or equivalent private connectivity keep multi-agent tool and knowledge traffic off the public internet while RBAC still authorizes callers. Open-to-world APIs, disabling TLS, and public connection strings violate compliance.
Full Explanation
Correct answer: A. Zero Trust multi-agent deployments combine network isolation with least-privilege identity. Place Foundry/agent compute such that egress to RAG indexes and MCP backends uses private networking; deny public data-plane paths where policy requires.
B is incorrect: unrestricted public exposure expands attack surface.
C is incorrect: TLS remains required in transit for enterprise multi-agent systems.
D is incorrect: publishing connection strings is a critical secret leak.
Document network and identity controls together in architecture decision records.