A security architect is designing a Zero Trust architecture for an AI pipeline that processes sensitive healthcare data. The AI models must be trained in a network-isolated environment where no internet access is permitted. Which Azure Machine Learning network configuration provides a fully isolated training environment with no public internet connectivity?

The correct configuration is the Azure Machine Learning workspace with a managed VNet configured in 'Allow only approved outbound' mode with all outbound internet rules disabled. In this mode, Azure Machine Learning restricts all outbound traffic from training compute to only explicitly approved destinations, such as Azure storage private endpoints and required Azure service endpoints. Disabling all outbound internet rules creates a fully isolated training environment where compute nodes have no internet access. The workspace with public network access disabled and a customer-managed VNet with no internet gateway is incorrect because a customer-managed VNet with no internet gateway achieves isolation but requires more complex customer management of VNet routing and private endpoints; the Azure Machine Learning managed VNet in 'Allow only approved outbound' mode provides the same isolation with Microsoft-managed network infrastructure. The workspace with a private endpoint and NSG rules blocking all outbound internet traffic from the compute subnet is incorrect because NSG rules on the compute subnet can block outbound internet but do not provide the same management simplicity as the Azure Machine Learning managed VNet and may still allow traffic that bypasses NSG through service endpoints. The workspace deployed in a dedicated subscription with no public IPs and Azure Policy denying public IP creation is incorrect because subscription-level restrictions and no public IPs provide organizational-level controls but do not specifically configure the Azure Machine Learning workspace network isolation mode.