An organization needs to implement network isolation for an Azure AI Foundry hub deployed in a managed virtual network. The AI models need to access an Azure Storage account but all access must remain private. What should be configured?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Azure AI Foundry managed virtual networks support outbound managed private endpoints that create private, isolated connections from the managed VNet to Azure resources like Storage accounts, ensuring all traffic traverses the Microsoft backbone without public internet exposure. A is incorrect because service endpoints for Azure Storage on managed VNet subnets are not supported in Azure AI Foundry managed virtual network configurations.
Full explanation below image
Full Explanation
B is correct because Azure AI Foundry managed virtual networks support outbound managed private endpoints that create private, isolated connections from the managed VNet to Azure resources like Storage accounts, ensuring all traffic traverses the Microsoft backbone without public internet exposure. A is incorrect because service endpoints for Azure Storage on managed VNet subnets are not supported in Azure AI Foundry managed virtual network configurations. C is incorrect because Azure Front Door is a global content delivery network, not a private network routing solution for service-to-service communication. D is incorrect because the Azure AI Foundry managed VNet is managed by Microsoft and does not support customer-configured VNet peering.