An organization needs to configure Azure AI Services to use a virtual network service endpoint and restrict access to resources only within a specific subnet. After enabling the service endpoint, requests from on-premises networks connected via ExpressRoute should still be permitted. Which configuration supports this topology?

The correct configuration is adding the Azure AI Services virtual network rule for the subnet and adding the on-prem public IP range to the IP firewall rules. Azure AI Services (Cognitive Services) network rules support two complementary controls: virtual network rules that restrict access to specific subnets with the service endpoint enabled, and IP network rules that allow specific public IP ranges. On-premises networks connected via ExpressRoute use private ASN-based routing but appear to Azure AI Services as originating from public IP addresses assigned to the on-premises network. Adding the on-prem public IP range to the IP firewall rules permits their traffic alongside the virtual network subnet rules. Configuring private endpoints for Azure AI Services to replace the service endpoint is wrong because switching to private endpoints is valid, yet it changes how all traffic reaches the service; the question asks about configuring within the service endpoint topology. Adding the subnet service endpoint and enabling 'Allow trusted Microsoft services' for ExpressRoute traffic is wrong because 'Allow trusted Microsoft services' bypasses the firewall for specific Microsoft services, such as Azure Backup and Azure Monitor, not for on-prem ExpressRoute traffic. Routing on-prem ExpressRoute traffic through an Azure VPN gateway before reaching AI Services is wrong because it adds unnecessary complexity and changes architecture away from the ExpressRoute topology.