AI-300 Practice Question 32: Workspace Selected IP Access
Microsoft Machine Learning Operations Engineer Associate (AI-300) · Test 4 · question 2 of 10
An Azure Machine Learning workspace is secured with a private endpoint in the company's virtual network, and its public network access is disabled. Data scientists who work from the two company offices cannot browse the studio from their desks unless they connect through the VPN, which the company wants to stop requiring for the offices. Access from the rest of the internet must remain blocked, and the offices have fixed public IPv4 ranges. What should the team do?
Show answer and explanation
Answer:
The Azure Machine Learning documentation describes exactly this option: *"To allow access to your workspace and endpoint from specific public internet IP address ranges, create IP network rules. Each Azure Machine Learning workspace supports up to 200 rules. These rules grant access to specific internet-based services and on-premises networks, and block general internet traffic."* Using az ml workspace update --public-network-access Enabled --network-acls "<cidr>,<cidr>" keeps the private endpoint for private access while admitting the offices' public ranges. Rules must be given in CIDR notation or as single IPv4 addresses (option B).
- A is wrong because enabling access from all networks opens the workspace to the whole internet, which the company wants to keep blocked. - C is wrong because the documentation warns that *"removing the private endpoints for a workspace doesn't make it publicly accessible"*. Public access is a separate setting, so deleting the endpoint would not help and would break private connectivity. - D is wrong because IP network rules *"only support public internet IP addresses,"* and reserved ranges such as the private addresses that start with 10, 172.16 to 172.31 and 192.168 are not allowed in the rules.
Reference: Configure a private endpoint - Azure Machine Learning