Microsoft Certified: Azure AI Engineer AssociatePlan and manage an Azure AI solutionEasy
A financial services company is developing an Azure AI solution to analyze customer sentiment from social media posts. The solution uses Azure Cognitive Services for Natural Language Processing (NLP). Due to strict regulatory compliance requirements, all data processed by the Cognitive Services must remain within the company's virtual network and must not be exposed to the public internet at any point. Which networking component should be used to achieve this secure and isolated communication?
- AAzure Load Balancer
- BAzure Virtual Network (VNet) service endpoints
- CAzure Application Gateway
- DAzure CDN (Content Delivery Network)
Show answer & explanationAnswer & explanation
Correct answer: B. Azure Virtual Network (VNet) service endpoints
Azure Virtual Network (VNet) service endpoints allow you to securely connect to Azure services directly over the Azure backbone network, keeping traffic within your VNet and preventing public internet exposure. This meets the strict compliance requirement for isolated communication.
Why the other options are wrong
- A. Azure Load Balancer distributes incoming network traffic across multiple backend resources and does not inherently provide VNet isolation for Azure services.
- C. Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications, not primarily for isolating backend service communication.
- D. Azure CDN is used to deliver web content to users based on their geographical location for faster performance, not for securing backend service communication within a VNet.
VNet Service Endpoints
Azure Virtual Network (VNet) service endpoints allow you to securely and directly connect to Azure services over the Azure backbone network, bypassing the public internet.
- Extends VNet private address space to Azure services.
- Traffic remains within the Azure backbone network.
- Provides enhanced security by eliminating public internet exposure.
Memory trick: Virtual Networks 'End' Public Exposure to Services.