A security architect needs to deploy an Azure AI Foundry workspace so that all training compute and inference endpoints are accessible only from within the corporate virtual network. No public endpoint exposure is acceptable. Which combination of configurations achieves this?

A is correct because disabling public network access on the Azure Machine Learning workspace and deploying private endpoints ensures all workspace management traffic traverses the private network. Using compute clusters with no public IP ensures training jobs and inference endpoints are fully network-isolated. B is incorrect because Azure Firewall can restrict traffic but the workspace would still have a public endpoint; the proper approach is disabling public access entirely. C is incorrect because NSG rules control traffic to resources in that subnet but do not disable the public endpoint of the Azure Machine Learning workspace itself. D is incorrect because Azure Container Instances are not the standard compute target for Azure Machine Learning and this does not address workspace management endpoint exposure.