A security engineer needs to configure an Azure AI Language resource used for document analysis to accept requests only from a specific Azure Virtual Network subnet. Which two resources must be configured to achieve this network restriction?

The correct configuration is to add a virtual network rule on the Azure AI Language resource allowing the specific subnet, and to enable the Microsoft.CognitiveServices service endpoint on that subnet. Both must be configured together: the service endpoint enables direct routing and subnet identity for the Azure AI Language service, while the virtual network rule on the Azure AI Language resource restricts inbound acceptance to that subnet. The option using Azure AI Language firewall rules to allow the subnet CIDR plus a Network Security Group rule denying all outbound traffic except to Azure AI Language is incorrect because NSG rules control traffic leaving the subnet but do not configure the Azure AI Language service to accept traffic only from that subnet; the service-side virtual network rule is required. The option using a private endpoint for Azure AI Language in the VNet plus an Azure Private DNS Zone for privatelink.cognitiveservices.azure.com is incorrect because private endpoints provide a different, stronger isolation mechanism than service endpoint network rules; it is a valid alternative approach, but it uses private endpoint architecture rather than service endpoint network rules. The option using Azure Firewall with an application rule allowing the subnet to reach the Azure AI Language FQDN plus an NSG rule allowing outbound port 443 is incorrect because Azure Firewall controls egress from the subnet but does not restrict the Azure AI Language service itself to accept requests only from that subnet.