A security architect needs to design a solution for detecting and preventing model theft (model extraction attacks) against an Azure OpenAI deployment used in a commercial SaaS product. Which combination of controls provides the most effective defense?

The correct combination is per-user rate limiting in Azure API Management, Azure OpenAI diagnostic logging, and Sentinel analytics rules to detect systematic API query patterns characteristic of model extraction. Model extraction attacks are characterized by systematic, high-volume querying designed to map the model's decision boundaries. A defense-in-depth approach requires per-user rate limiting to slow extraction attempts, comprehensive diagnostic logging of all API calls, and Sentinel analytics rules to detect the characteristic patterns of model extraction, such as high volume, systematic query distribution, and repeated similar inputs from a single caller. The DDoS Protection Standard option with Azure OpenAI rate limiting per subscription key is incorrect because DDoS Protection addresses volumetric attacks and rate limiting slows but does not detect or prevent systematic model extraction that operates below rate limits. The multi-factor authentication and TLS 1.3 option is incorrect because MFA and TLS protect authentication and transport security but do not prevent authorized users from performing systematic model extraction queries. The Azure Web Application Firewall option with the OWASP ruleset in front of the Azure OpenAI endpoint is incorrect because WAF with OWASP rules blocks common web application attacks, but model extraction does not use web attack patterns; WAF rules would not recognize model extraction query patterns.