A bank's security policy requires that every call to its Foundry project and model endpoints stay entirely on the corporate private network, with no traffic ever traversing the public internet. Which Foundry network configuration satisfies this requirement?
Select an answer to reveal the explanation.
Short Explanation
The requirement here is really specific - not 'encrypted' and not 'authenticated,' but never touching the public internet at all, full stop. That is a network-routing problem, and the tool built for exactly that is a private endpoint: it gives the Foundry hub an address that only exists inside the bank's own network, and turning off public access makes sure no other door is left open. Requiring an API key is a different kind of protection - it checks who is calling, but it does not change what wires the call travels over, so a perfectly valid, correctly authenticated request could still cross the open internet on its way in. Leaning on the content filter is even further off target - that looks at what is being said, not where the connection came from. And requiring HTTPS just wraps the same public-internet trip in encryption; it is still a trip across the public internet, just a locked one. To actually keep every call on the private network, you need the private endpoint doing the routing.
Full Explanation
The correct answer is C. A private endpoint gives the Foundry hub a private IP address inside the bank's virtual network, and disabling public network access ensures that the only path to the hub and its model endpoints is through that private connection, which is the configuration that actually keeps traffic off the public internet as the policy requires. Option A is incorrect because an API key controls authentication and authorization for a request, not the network path that request travels; a correctly authenticated call can still cross the public internet before it ever reaches the endpoint. Option B is incorrect because content safety filtering screens the content of a request or response for policy violations, it does not control or restrict which network a connection is routed over, so it does nothing to keep traffic private. Option D is incorrect because HTTPS encrypts traffic in transit but does not change its path; an encrypted request over the public internet is still public internet traffic, which does not meet a requirement that traffic never traverse it at all. Only a private endpoint paired with disabling public access actually removes the public internet from the path between callers and the Foundry project.