AI-102 Implement an agentic solution Practice Question
You are designing an agent using Microsoft Copilot Studio that must handle sensitive employee data such as salaries and performance reviews. The agent should only allow HR managers to access these topics. The solution must comply with data privacy regulations. Which two actions should you take? (Select two.)
⚠ Common exam trap
It's easy for candidates to confuse bot-level authentication settings with topic-level security, assuming that simply requiring authentication at the bot level is sufficient to restrict access to specific topics, when in fact you must also configure role-based conditions on each sensitive topic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure authentication in Copilot Studio to require Microsoft Entra ID sign-in.
Microsoft Entra ID (formerly Azure AD) authentication is required to enforce role-based access control in Copilot Studio. Without Entra ID, the agent cannot verify the identity of the user or check group membership, which is essential for restricting sensitive topics like salaries and performance reviews to HR managers only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set bot-level authentication to require a specific role.
Why it's wrong here
Bot-level authentication does not restrict topics; role-based access must be at topic level.
- ✓
Configure authentication in Copilot Studio to require Microsoft Entra ID sign-in.
Why this is correct
Authentication verifies the user's identity.
- ✗
Enable detailed audit logging in Microsoft Purview.
Why it's wrong here
Audit logs track activity but do not control access.
- ✗
Apply data loss prevention policies in Microsoft Purview.
Why it's wrong here
DLP policies prevent data exfiltration but do not control access within the agent.
- ✓
Configure topic-level security to restrict access to HR managers.
Why this is correct
Topic-level security allows you to specify which users or roles can access a topic.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AI-102 question from scratch — 945 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.