A security architect is reviewing the network security design for an Azure OpenAI deployment. The organization has an on-premises proxy server that all internet traffic must pass through for inspection. The AI application running on Azure App Service needs to call Azure OpenAI via the private endpoint. How should the network route be configured?

D is correct because the optimal architecture uses App Service regional VNet Integration to enable the App Service to reach the Azure OpenAI private endpoint directly within Azure's network (bypassing the internet and the on-premises proxy for this specific traffic), while a User Defined Route can direct only internet-bound traffic to the on-premises proxy via ExpressRoute. This provides security inspection for internet traffic without routing internal Azure service traffic unnecessarily through on-premises. A is incorrect because bypassing the on-premises proxy for Azure OpenAI calls is correct, but the description must clarify that only Azure private traffic uses this path; internet traffic still needs the proxy. B is incorrect because routing Azure OpenAI calls through an on-premises proxy adds significant latency, a potential bottleneck, and defeats the purpose of private endpoints. C is incorrect because APIM adds another service component and does not replace the requirement for proper network routing.