You have an Azure Cognitive Search resource named Search 1 that is used by multiple...

You are securing an Azure Cognitive Search resource with two specific requirements:

Prevent access to Search1 from the internet

The correct way is to use a private endpoint.

A private endpoint connects the Cognitive Search resource directly into your virtual network (VNet), blocking public internet access.

Configuring an IP firewall can restrict access to specific IP ranges but does not fully prevent internet access.

Azure roles and authentication do not address network-level restrictions.

Limit the access of each app to specific queries

This is done via Azure role-based access control (RBAC).

You can assign different Azure roles or API keys with query rights to control what each app can do.

Key authentication alone only provides coarse-grained access (admin/query keys) but does not allow fine-grained per-app restrictions.

RBAC ensures principle of least privilege is enforced.

Correct Answer:

Prevent access from internet → Create a private endpoint

Limit access to queries → Use Azure roles

Secure access to Azure Cognitive Search using private endpoints

Role-based access control in Azure Cognitive Search

Microsoft References