A company is deploying a Retrieval Augmented Generation (RAG) AI system that retrieves documents from Azure AI Search and uses Azure OpenAI to generate responses. The security team needs to implement defense-in-depth for this architecture. Which combination of controls provides comprehensive protection across the retrieval and generation layers?

A is correct because a RAG system has two distinct attack surfaces requiring separate controls: (1) The retrieval layer—where malicious documents in the index could contain indirect prompt injection payloads; Prompt Shield document scanning detects injected instructions in retrieved documents before they enter the context window. (2) The generation layer—where Azure OpenAI content filtering prevents the model from generating harmful or policy-violating responses. (3) Access control—ensuring users can only retrieve documents they are authorized to see prevents unauthorized data disclosure through AI-generated summaries. Together, these three controls form a defense-in-depth architecture for RAG. B is wrong because HTTPS and WAF protect transport security and web application vulnerabilities, not the AI-specific threats in a RAG system like indirect prompt injection or unauthorized content retrieval. C is wrong because sensitivity labels and DLP protect against data leakage through labeling, but do not protect against prompt injection in retrieved documents or content policy violations at generation time. D is wrong because API Management with rate limiting and IP filtering controls API access and prevents abuse, but does not address the AI-layer threats of prompt injection and harmful content generation.