Microsoft Certified: Azure AI Apps and Agents Developer Associate (AI-103) (AI-103) (AI-103) — Questions 151–225

Option A is correct because Custom Vision containers must periodically connect to Azure (or maintain internet connectivity) to send usage/billing metering data; without this metering connection the container will not run. Option B is correct because the container requires the Billing Endpoint URI (e.g., https://<region>.api.cognitive.microsoft.com) and the associated API Key, supplied as environment variables such as Billing and ApiKey, so Azure can validate and meter the resource. Option C is correct because the container image requires explicit acceptance of the End-User License Agreement via the EULA=accept environment variable before it will start.

Option D is not required because the Azure CLI is not installed inside the prediction container; billing is handled through the endpoint and key. Option E is not required and is not a supported configuration; no root access to the Azure billing portal from inside the container is needed.

Temperature (A) is correct because it scales the randomness of the model's token probability distribution—higher values like 1.0+ flatten the distribution and produce more varied, 'creative' outputs, while lower values sharpen it toward deterministic responses. Top-P (C), or nucleus sampling, is correct because it restricts sampling to the smallest set of tokens whose cumulative probability exceeds P; raising P (e.g., 0.9–1.0) admits more candidate tokens and increases output diversity. Frequency Penalty (D) is correct because it penalizes tokens proportionally to how often they have already appeared, discouraging repetition and thereby pushing the model toward more varied, novel phrasing.

The search index threshold (B) governs retrieval grounding—how many or how similar documents must be before they are surfaced—so it affects factual grounding, not generative creativity. The system prompt length (E) is not a creativity parameter; prompt content and length shape behavior and context, but they do not directly tune the sampling distribution the way temperature, top-P, and frequency penalty do.

Azure Budgets (A) is correct because it lets you set spending thresholds on a scope such as a subscription, resource group, or resource and trigger alerts or actions when actual or forecasted costs approach or exceed the limit, which is essential for controlling an AI solution budget. Azure Advisor cost recommendations (B) is correct because it analyzes your resource usage and configuration and surfaces specific, actionable suggestions — such as right-sizing underutilized VMs or removing idle resources — that directly reduce AI workload spend. Azure Cost Analysis (C) is correct because it provides the reporting and visualization layer for cost management, allowing you to break down and filter actual costs by service, resource, tag, and time period so you can understand where AI-related spending is going.

Azure Active Directory (D) is an identity and access management service, not a cost management tool, and Azure Container Registry (E) is a private Docker/OCI image registry for storing and managing container images, so neither addresses budget monitoring or optimization.

Option D is correct because implementing caching for common query results reduces the number of calls made to the Azure AI service, lowering latency and throttling risk while returning frequently requested data faster from a local or distributed cache such as Azure Cache for Redis. Option E is correct because deploying the AI resource in a region closer to end-users reduces network round-trip time (RTT) and thus improves perceived response latency for the application. Option A is not correct because adding subscription keys does not increase throughput or performance; keys are for authentication, and quota/rate limits are tied to the resource and pricing tier, not the number of keys.

Option B is not correct because disabling logging does not meaningfully improve AI inference performance and removes valuable diagnostics and monitoring. Option C is not correct because the Free tier has lower rate limits and quotas than paid tiers, so switching to it would degrade rather than improve performance.

Prebuilt NER in Azure AI Language is designed to identify and categorize entities in text into general types such as Person, Location, Organization, DateTime, and Quantity. Option B is correct because extracting person names from text is a core prebuilt NER capability, returning entities of the Person category. Option C is correct because identifying geographic locations maps directly to the Location (and related GPE) entity categories that prebuilt NER recognizes.

Option A is not part of NER; language detection is a separate Azure AI Language feature that returns the detected language and confidence score. Option D is not NER; redacting credit card numbers is handled by PII detection/redaction, which identifies sensitive data and can mask it, rather than general named entity extraction. Option E is not NER; classifying entire documents into custom business categories is a custom text classification task that requires training a model, not the prebuilt NER model.

Option B is correct because Prompt Flow agents accept a messages list in which prior user/assistant turns are included, so passing conversation history as part of that messages list supplies the dialogue context the agent needs to resolve references and maintain continuity. Option C is correct because injecting retrieved documents into the prompt template (the retrieval-augmented generation pattern, e.g., via a vector index lookup node whose output is bound into the prompt) places relevant grounding text directly in the model's context window. Option A is wrong because region selection only affects data residency, latency, and model availability, not the contextual information given to the agent.

Option D is wrong because increasing the model output length (max_tokens) only changes how many tokens can be generated, not what context is provided. Option E is wrong because training a new model changes weights rather than supplying runtime context, and it is not a Prompt Flow context-injection mechanism.

Option D is correct because Azure resource tags let you attach department or cost-center metadata to each Azure AI service resource, and Cost Management cost analysis can then group and filter costs by those tag keys, directly attributing spend to the right department. Option E is correct because Azure Cost Management budgets track spend against thresholds and its exported CSV cost reports provide the raw, granular usage and charge data needed for accurate offline analysis and chargeback. Option A is wrong because Azure Bastion session logs record RDP/SSH connectivity activity, not billing or cost data.

Option B is wrong because Entra ID (Azure AD) enterprise group memberships govern identity and access, not cost attribution. Option C is wrong because Microsoft Defender for Cloud security recommendations address security posture, not cost analysis or allocation.

Option A is correct because a Private Endpoint exposes the Azure AI Language resource through a private IP address in the client's virtual network, so the client subnet must have valid routing (for example, via the default VNet routing or a configured route table) to reach that private IP; if routing is broken, connections fail even if DNS resolves correctly. Option D is correct because name resolution must map the Azure AI Language endpoint FQDN to the Private Endpoint's private IP, which requires the corresponding Private DNS zone (for example, privatelink.cognitiveservices.azure.com) to be linked to the client virtual network; without that link, clients resolve the public IP and cannot connect privately. Option B is not relevant because Storage Blob Data Contributor is an Azure Storage RBAC role and has no bearing on connecting to an Azure AI Language resource.

Option C is not relevant because retraining Azure OpenAI model weights is unrelated to Private Endpoint connectivity for Azure AI Language. Option E is incorrect because enabling unrestricted public network access would bypass the private-only access model rather than troubleshoot the Private Endpoint connection, and it may violate the intended security configuration.

Option C is correct because the Read API's OCR accuracy and speed depend on image resolution; downscaling extremely large images to dimensions that keep text legible reduces upload size and server-side processing time, lowering latency. Option D is correct because the Read API is asynchronous: you submit an image, receive an Operation-Location URL, and must poll the GET result endpoint; using a sensible interval such as 1 second avoids throttling (HTTP 429) and wasted requests that aggressive busy-waiting causes, improving effective throughput. Option E is correct because placing the calling application and the Azure AI Vision resource in the same Azure region minimizes network round-trip time for both the initial POST and the subsequent polling GETs, directly reducing latency.

Option A is not appropriate because the Read API accepts JPEG, PNG, BMP, PDF, and TIFF, and sending uncompressed RAW bitmap data would inflate payload size and transfer time rather than bypass meaningful decoding overhead. Option B is not appropriate because disabling SSL/TLS verification weakens security, does not meaningfully speed up TCP handshakes, and is not a supported optimization for the Azure AI Vision Read API.

Option A (Human-in-the-loop review for high-impact tool actions) is correct because agentic solutions that call external line-of-business systems can perform destructive or financially significant operations, so gating high-impact tool invocations behind human approval provides a safety control that prevents irreversible mistakes. Option D (Exponential backoff and jitter retry logic for handling API rate limits (HTTP 429)) is correct because external LOB APIs commonly throttle callers and return HTTP 429, and retrying with exponentially increasing delays plus randomized jitter avoids thundering-herd retries and improves robustness against transient throttling. Option E (Structured Outputs with strict JSON Schema validation for tool payloads) is correct because enforcing a strict JSON Schema on tool inputs and outputs guarantees that the agent emits well-formed, type-safe arguments that the downstream LOB system can parse, reducing malformed calls and injection-style errors.

Option B is wrong because executing arbitrary bash commands on production servers without validation is a severe security and reliability risk, not a robustness pattern. Option C is wrong because disabling logging and monitoring removes observability, auditability, and the ability to detect failures or misuse, which directly undermines safety and robustness.

Option A is correct because the Reflection pattern explicitly has the agent generate an initial output, critique it, and iteratively refine intermediate results, which directly supports the required self-evaluation and improvement loop. Option B is correct because ReAct interleaves reasoning traces (thoughts) with actions/tool calls and observations, enabling iterative sub-task execution and dynamic adjustment based on intermediate results. Option E is correct because Plan-and-Solve first decomposes the problem into a complete multi-step plan and then executes the steps, matching the need to break complex reasoning into distinct sub-tasks before iterating through them.

Option C is not appropriate because static hardcoded IF-ELSE trees do not use model inference and cannot adaptively reason or reflect on intermediate outputs. Option D is not appropriate because single-turn stateless completions with temperature 0 provide no iterative loop, no memory of prior steps, and no mechanism for reflection or tool execution.

Option A is correct because Managed Identities combined with Azure RBAC eliminate the need to embed credentials in code or configuration, allowing the RAG application's components (e.g., Azure OpenAI, Azure AI Search, Storage) to authenticate to each other through Microsoft Entra ID tokens with least-privilege role assignments. Option C is correct because Azure Private Endpoints place Azure OpenAI and Azure AI Search on a private IP within your virtual network, removing exposure to the public internet and satisfying network isolation and data-exfiltration compliance requirements. Option E is correct because Customer-Managed Keys stored in Azure Key Vault give you control over the encryption keys protecting data at rest in Azure OpenAI, Azure AI Search, and storage accounts, which is a common regulatory requirement for key ownership and revocation.

Option B is not correct because granting anonymous public network access on AI service firewalls exposes the services to unauthenticated internet traffic and violates the security and compliance goals of the scenario. Option D is not correct because storing API keys in plain text in public GitHub repositories leaks credentials and is a severe security anti-pattern that contradicts every stated requirement.

Option C is correct because Azure AI Foundry's safety evaluation metrics specifically include sexual content and violence severity scores, which quantify harmful content categories in generated outputs and are part of the built-in risk and safety evaluators. Option E is correct because hate speech and unfairness detection are also standard safety metrics in Azure AI Foundry, covering hateful or discriminatory language and bias/unfairness assessments of model responses. These metrics align with the Azure AI Content Safety categories (hate, violence, sexual, self-harm) plus fairness evaluations used to assess generative AI risk.

Options A and B are incorrect because database transaction log growth rate and storage account geo-replication latency are infrastructure/storage performance measures, not safety or risk metrics for generative AI. Option D is incorrect because network bandwidth throughput in megabits per second is a networking performance metric, unrelated to evaluating content safety or fairness risks.

Option A is correct because when using customer-managed keys (CMK) with Azure AI services, the AI service's managed identity must be granted access to the Key Vault key via an access policy or RBAC role (e.g., Key Vault Crypto Service Encryption User) so the service can wrap/unwrap the data encryption key. Option C is correct because you must provision an Azure Key Vault to hold the CMK, and enabling soft-delete and purge protection is mandatory for CMK scenarios to prevent accidental or malicious key deletion that would render encrypted data unrecoverable. Option D is correct because the CMK must be bound to the Azure AI services account by setting the customer-managed key identifier (the Key Vault key URI) in the account's encryption properties, which is what actually switches encryption from Microsoft-managed keys to your organization's keys.

Option B is wrong because storing private keys in plain text in source code is a severe security anti-pattern and is never a valid configuration step. Option E is wrong because disabling diagnostic logging has no bearing on encryption key management and would actually undermine compliance and auditing requirements.

Option A is correct because enabling autoscaling on the Azure AI endpoint dynamically adjusts the number of compute instances based on metrics such as CPU utilization, request rate, or token throughput, allowing the deployment to absorb high-volume traffic without manual intervention. Option E is correct because implementing a global load balancer such as Azure Front Door distributes incoming requests across multiple regional endpoints, provides layer-7 routing, TLS offload, caching, and failover, which collectively improve throughput and resilience under heavy load. Option B is incorrect because limiting access to a single user artificially restricts concurrency and does nothing to increase capacity for high-volume traffic.

Option C is incorrect because hardcoding the IP address of a compute node bypasses DNS-based load balancing and creates a single point of failure, preventing traffic from being spread across instances. Option D is incorrect because the Free pricing tier enforces strict rate and quota limits, making it unsuitable for high-volume production traffic.

Option A is correct because Azure Monitor metric alerts on latency and availability metrics provide the observability needed to detect degradation of an Azure OpenAI resource and trigger operational or automated responses before users are severely impacted. Option B is correct because Azure OpenAI returns transient errors such as HTTP 429 (rate limiting) and 5xx responses, so client-side retry with exponential backoff and failover to a secondary endpoint/region is essential for resilience and continuity. Option D is correct because deploying secondary Azure OpenAI resources in a paired Azure region enables regional redundancy and supports failover if the primary region becomes unavailable, which is a core HA/DR pattern.

Option C is not correct because Azure Backup does not snapshot live model memory states or the internal runtime state of an Azure OpenAI model; it is for supported Azure resource data, not model inference memory. Option E is not correct because Azure OpenAI models run as a managed cloud service and cannot be executed offline on client laptops, and storing model weights locally is neither supported nor part of an Azure HA/DR design.

Opinion mining (aspect-based sentiment analysis) decomposes an evaluated sentence into its key components: option B is correct because it returns the sentiment polarity (positive, negative, or neutral) associated with a specific aspect, which is the core output of the analysis. Option C is correct because it identifies the target aspect, such as 'room' or 'staff', i.e., the entity or feature being evaluated in the sentence. Option D is correct because it extracts the assessment evaluation, such as 'clean' or 'rude', which is the descriptive term expressing the opinion about the aspect.

Options A and E are incorrect because compiler error logs and network bandwidth utilization metrics are unrelated to natural language opinion mining outputs; they belong to software development and network monitoring domains, respectively.

Option A is correct because the Azure AI Foundry evaluation service provides a results dashboard/portal experience where you can visualize evaluation runs, compare metrics across models or datasets, and drill into per-row scores. Option B is correct because the service ships built-in evaluators for RAG and generative AI scenarios, including quality metrics such as coherence, fluency, groundedness, and relevance, which can be applied without writing custom scoring logic. Option D is correct because the evaluation service supports custom evaluators, allowing you to bring your own evaluation code (for example, Python-based custom metrics) and register it alongside built-in evaluators.

Option C is not part of the evaluation service: fine-tuning is a separate model customization capability, and evaluation does not automatically retrain or fine-tune models based on failures. Option E is not provided by the evaluation service: UI generation is unrelated to evaluation, which focuses on measuring and reporting model output quality rather than generating application interfaces.

Azure AI Agents support tool integration through several mechanisms, and Azure AI Search indexes (A) are correct because they can be attached as knowledge/retrieval tools, enabling the agent to ground responses in indexed enterprise data via the Azure AI Search service. Custom Python functions (B) are correct because agents can call user-defined functions (function calling/tool use) to execute custom logic, calculations, or data processing at runtime. External REST APIs (D) are correct because agents can invoke OpenAPI-specified or HTTP-based tools to reach external services and return results into the conversation.

Hard drive file systems (C) are not a supported agent tool type, since agents run as cloud services without direct access to a user's local disk, and operating system kernel drivers (E) are not integrable tools because agents operate at the application/service layer, not the OS kernel level.

Option A is correct because the Azure AI Language sentiment analysis response includes a 'sentences' array where each sentence carries its own 'sentiment' label and 'confidenceScores' (positive, neutral, negative), enabling sentence-level analysis. Option B is correct because every document and sentence in the payload contains a 'confidenceScores' object with numeric values for the positive, neutral, and negative classes. Option D is correct because the top-level document object returns an overall 'sentiment' value that can be positive, negative, neutral, or mixed (mixed applies when sentence sentiments conflict).

Option C is incorrect because sentiment analysis does not perform translation; that is a separate Azure AI Translator capability. Option E is incorrect because grammar and spelling correction is not part of the sentiment analysis response payload.

Option A is correct because explicit system prompt instructions that tell the model to refuse or say it doesn't know when the retrieved context does not support an answer constrain the model to grounded responses and reduce fabricated content. Option B is correct because including source document chunk citations alongside the retrieved text in the prompt context gives the model verifiable references and encourages it to anchor its output to the supplied evidence rather than inventing facts. Option C is incorrect because disabling content safety filters removes guardrails and does nothing to improve grounding; it can actually increase harmful or unsupported output.

Option D is incorrect because setting temperature to 2.0 maximizes randomness and creativity, which increases hallucination risk rather than reducing it. Option E is incorrect because removing all source context documents eliminates the grounding data entirely, forcing the model to rely on parametric memory and making hallucinations far more likely.

Option C is correct because Azure AI Language key phrase extraction is designed to process unstructured text documents, such as customer feedback, reviews, or free-form comments, without requiring any special formatting or pre-labeling. Option D is correct because the Key Phrase Extraction API returns a list of strings representing the main talking points or key phrases found in the input text, which is exactly what is needed to extract key concepts from customer feedback. Option A is incorrect because evaluating emotional tone is the job of sentiment analysis, not key phrase extraction.

Option B is incorrect because key phrase extraction does not rely on a pre-defined taxonomy of thousands of categories; that describes custom text classification or entity linking with a taxonomy. Option E is incorrect because automatic translation is a separate Azure AI service (Translator), not a feature of key phrase extraction.

In Azure AI Language custom text classification, the evaluation page in Language Studio reports standard classification quality metrics: F1-score (B), Precision (C), and Recall (E). Precision measures the proportion of predicted labels that are correct, Recall measures the proportion of actual labels that were correctly identified, and F1-score is the harmonic mean of Precision and Recall, giving a balanced single-number summary of model quality. These three metrics are computed per class and as overall/macro averages, which is exactly what Language Studio surfaces for assessing a custom text classification model.

HTTP request latency (A) and CPU utilization percentage (D) are operational/infrastructure performance measures, not model-quality evaluation metrics, so they are not provided for assessing classification accuracy.

Option A is correct because the tool's description tells the agent what the tool does and, critically, when it should be invoked, which guides the model's decision to call it. Option D is correct because the tool's name is the identifier the agent uses to reference and invoke the specific function in its tool-call output. Option E is correct because the JSON schema for the function arguments defines the exact parameter names, types, and required fields the agent must supply, ensuring valid, parseable arguments.

Option B is not required in the tool definition; rate limiting is an operational/policy concern handled outside the tool's schema. Option C is wrong because hardcoding authentication credentials in the tool definition is insecure and unnecessary—credentials should be managed via secure configuration, not embedded in the tool spec.