An Azure AI engineer needs to deploy Azure OpenAI Service so that it is not accessible over the public internet. All traffic must travel over the Microsoft backbone network from the application tier. Which network control achieves this?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need a private endpoint for the Azure OpenAI resource inside the application VNet, and you must disable public network access. That puts a private IP in your VNet and forces traffic over the Microsoft backbone instead of the public internet. Make sure DNS resolves the endpoint to that private IP.
Full Explanation
Configuring a private endpoint for the Azure OpenAI resource within the application VNet and disabling public network access is correct because Azure Private Endpoint creates a private IP address within your VNet that maps to the Azure OpenAI resource, and disabling public network access ensures that all traffic uses this private path over the Microsoft backbone rather than the public internet. The DNS for the Azure OpenAI endpoint must also be configured to resolve to the private IP. The IP firewall rules option that allows only RFC 1918 addresses is wrong because IP firewall rules restrict which public IPs can access the service but still route traffic over the public internet; they do not eliminate internet exposure. The Azure API Management with a WAF policy option is wrong because Azure API Management with WAF adds a management and security layer but still requires the Azure OpenAI endpoint to be accessible, and Azure API Management itself has a public IP unless it also uses private endpoints. The Azure DDoS Protection Standard option is wrong because DDoS Protection defends against volumetric attacks but does not prevent public internet access to the resource.