A security architect is designing a defense-in-depth strategy for an Azure AI solution that processes healthcare records. The architect needs to identify which control most directly addresses the risk that a malicious insider with Azure subscription Owner role could extract training data.

B is correct because encrypting training data with customer-managed keys where the Key Vault access policy is controlled by a separate security team creates cryptographic separation between the Azure subscription Owner and the training data. An Owner cannot access plaintext training data without the separate security team's authorization for key access. A is incorrect because PIM reduces the time an Owner has elevated access but does not prevent access to training data during the activation window. C is incorrect because network isolation prevents external exfiltration paths but does not protect against an insider with Owner access who could modify network configurations. D is incorrect because Sentinel alerts provide detection after the fact but do not prevent a determined insider from exfiltrating data before the alert is acted upon.