A retail company is moving its Foundry-hosted customer chatbot from a development subscription into production, where it will handle real customer conversation data. The security team wants to reduce the deployment's exposure to the public internet and ensure that only authorized engineers can view or rotate the encryption keys protecting stored conversation logs. (Select TWO.)
Select all correct answers, then click Submit.
Short Explanation
Moving a chatbot from a test environment into handling real customer data usually means locking down two separate things: who can even reach the service over the network, and who can touch the keys protecting the data at rest. Those are genuinely different concerns, so you need a control for each. Restricting network reachability so the service is only visible from inside the company's own network handles the first worry, keeping it away from the open internet. Putting the encryption keys under the company's own control and limiting who has permission to view or rotate them handles the second worry, key governance. Neither of those two goals has anything to do with how varied the chatbot's wording sounds or how much conversation history it can hold onto per session, those are unrelated dials entirely. The two controls that actually match reducing internet exposure and restricting key access are the ones worth reaching for here.
Full Explanation
The correct answers are C and D. A private endpoint restricts network reachability to the company's own virtual network instead of the open internet, directly reducing public exposure, while customer-managed keys combined with role-based access control let the security team control exactly who is authorized to view or rotate the encryption keys protecting stored conversation logs, satisfying both stated requirements together. Option A is incorrect because temperature is a generation parameter that affects how varied response wording is, it has no relationship to network exposure or key management access. Option B is incorrect because context window size determines how much conversation text the model can process per session, it does not control network reachability or who can manage encryption keys. Since the security team's two goals are limiting internet exposure and restricting key management access, the two controls that map directly onto those goals, network isolation through a private endpoint and key access governance through customer-managed keys with RBAC, are the correct selections, while the generation-parameter and capacity-related options address unrelated concerns.