A security architect needs to design a solution for detecting and preventing model theft (model extraction attacks) against an Azure OpenAI deployment used in a commercial SaaS product. Which combination of controls provides the most effective defense?

B is correct because model extraction attacks are characterized by systematic, high-volume querying designed to map the model's decision boundaries. A defense-in-depth approach requires: per-user rate limiting (APIM) to slow extraction attempts, comprehensive diagnostic logging of all API calls, and Sentinel analytics rules to detect the characteristic patterns of model extraction (high volume, systematic query distribution, repeated similar inputs from a single caller). A is incorrect because DDoS Protection addresses volumetric attacks and rate limiting slows but does not detect or prevent systematic model extraction that operates below rate limits. C is incorrect because MFA and TLS protect authentication and transport security but do not prevent authorized users from performing systematic model extraction queries. D is incorrect because WAF with OWASP rules blocks common web application attacks but model extraction does not use web attack patterns; WAF rules would not recognize model extraction query patterns.