Plan and manage an Azure AI solution 1.2 Set up AI solutions in Foundry

Your Foundry resource has two projects and connections to an Azure Storage account and an…

Study guide skill: Design Azure infrastructure for AI apps and agent-based solutions

Question B4-005

Your Foundry resource has two projects and connections to an Azure Storage account and an Azure AI Search service. The security team disables public network access on the Foundry resource and assumes that the Storage account and the search service are now private too. What should you tell them?

Select one answer.

  • A Network access is set per project, so each project must also disable public access before the connected resources become private
  • B Deleting and re-creating the connections applies the Foundry resource's network settings to the connected resources
  • C Storage and AI Search are separate Azure resources with their own governance boundaries, so their networking and access policies must be configured on those resources ✓ Correct answer
  • D Connected resources inherit the Foundry resource's network settings through the project connections

Answer: C

The architecture guidance says that connected resources like Storage, Key Vault, and Azure AI Search are independent Azure resources, and you manage their networking, access policies, and compliance settings separately from the Foundry resource. Networking is a governance setting of the top-level Foundry resource, not of each project. Connections only reference the connected resources; they don't push settings to them.

Deep dive

How it works

The Foundry architecture separates three layers:

  • Foundry resource: the top-level Azure resource where you manage governance settings such as networking, security and model deployments.
  • Project: a development boundary inside the Foundry resource. Projects reuse the resource's model deployments and connections without repeated IT setup.
  • Connected resources: Azure services such as Storage, Key Vault and Azure AI Search that the Foundry resource references through connections.

The architecture page puts the key point in an Important note: connected resources are independent Azure resources with their own governance boundaries. You manage their networking, access policies and compliance settings separately from the Foundry resource.

So disabling public network access on the Foundry resource locks down the Foundry endpoint only. To make the Storage account and the search service private, configure their own firewalls or private endpoints and access policies on those resources.

The other options, and when you'd use them

  • Network access set per project: Networking is a governance setting of the top-level Foundry resource. Projects are development boundaries inside it, not separate network perimeters.
  • Re-create the connections: Connections are how the Foundry resource references the connected services. Re-creating them doesn't change those services' own governance boundaries.
  • Inherit through connections: The same guidance says the opposite: you manage the connected resources' networking and access policies independently.

Exam tip

Locking down Foundry doesn't lock down what it connects to. Storage, Key Vault and AI Search each need their own network configuration.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Plan and manage questions · AI-103 study guide

Thanks for your feedback!