An organization needs to implement network isolation for an Azure AI Foundry hub deployed in a managed virtual network. The AI models need to access an Azure Storage account but all access must remain private. What should be configured?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — configure the managed private endpoint from the AI Foundry managed VNet to the Azure Storage account. That gives you a private, isolated connection over the Microsoft backbone, so model access to Storage stays off the public internet.
Full Explanation
Configuring a managed private endpoint from the AI Foundry managed VNet to the Azure Storage account is correct because Azure AI Foundry managed virtual networks support outbound managed private endpoints that create private, isolated connections from the managed VNet to Azure resources like Storage accounts, ensuring all traffic traverses the Microsoft backbone without public internet exposure. Creating a service endpoint for Azure Storage on the AI Foundry managed VNet subnet is incorrect because service endpoints for Azure Storage on managed VNet subnets are not supported in Azure AI Foundry managed virtual network configurations. Deploying Azure Front Door to route traffic from AI Foundry to Azure Storage privately is incorrect because Azure Front Door is a global content delivery network, not a private network routing solution for service-to-service communication. Configuring a VNet peering between the AI Foundry managed VNet and the storage account VNet is incorrect because the Azure AI Foundry managed VNet is managed by Microsoft and does not support customer-configured VNet peering.