Select Two (Multi-Select) Questions

A list of all users authorized to use the agent.

Why it fails: Authorised-user lists govern authentication and access control, not the instructions defining the agent's role, tone and boundaries. It tempts because agent configuration genuinely includes user permissions, but those are enforced by identity and security layers rather than by the system prompt itself.

The full training dataset of the base model.

Why it fails: Training data is baked into the base model's weights during pre-training and cannot be supplied or altered through a system prompt at inference time. It tempts because prompt engineering and fine-tuning are easily conflated, yet fine-tuning is the mechanism that would actually incorporate a dataset.

A list of all hardware components in the data center.

Why it fails: Hardware inventories describe physical infrastructure, not the behavioural instructions, role, tone or constraints a system prompt encodes for the model. It tempts because deployment planning documents do list infrastructure, but that content belongs in operational runbooks, never in the prompt shaping model responses.

Azure DevOps commit history dashboard

Why it fails: Commit history dashboards report source-control activity in Azure DevOps pipelines, not runtime token consumption or error rates from Azure OpenAI. It is tempting because it tracks deployment changes, and would be correct when correlating code releases with pipeline build outcomes.

Microsoft 365 compliance center content search

Why it fails: Content search queries Microsoft 365 workloads such as Exchange and SharePoint, so it cannot read Azure OpenAI telemetry. It is tempting because it is a genuine investigation tool, and would be correct when locating email or document evidence for a compliance case.

Azure Bastion session monitor

Why it fails: Bastion session monitoring records RDP/SSH session activity through Azure Bastion, not Azure OpenAI token counts or error rates. It is tempting because Bastion provides connection-level auditing, which would be the right choice when you need to log administrative session access to virtual machines.

Sharing a single Azure subscription across all departments without using tags or resource groups.

Why it fails: A single untagged subscription gives no dimension to attribute charges, so departmental costs cannot be separated. It is tempting because one subscription appears to reduce administrative effort, but cost allocation demands tags or separate resource groups and subscriptions per department.

Deactivating Azure Cost Management to reduce management overhead.

Why it fails: Deactivating Azure Cost Management removes the very service that reports and segments spend, so no departmental allocation data exists. It is tempting as a way to cut management overhead, but Cost Management is precisely the tool for cost visibility; disabling it defeats the stated requirement rather than simplifying it.

Provisioning all AI resources in the Free (F0) tier.

Why it fails: The Free (F0) tier caps usage and offers no billing granularity, so departmental cost allocation becomes impossible; F0 suits evaluation or proof-of-concept work only. It is tempting because F0 avoids charges entirely, but tracking and allocating spend requires paid tiers combined with tags and Cost Management.

The background color of the source documents in blob storage.

Why it fails: Background colour is a visual property that embedding models ignore; chunking strategy, embedding model choice and index configuration drive retrieval relevance. It is tempting because preprocessing steps feel relevant, and colour would matter for a computer vision classifier distinguishing documents by template or branding.

The font family used in the original PDF documents.

Why it fails: Font family affects rendering only; text is extracted before embedding, so glyph style cannot change vector quality. It is tempting because document formatting appears to influence parsing, and font choice would be correct when tuning an OCR pipeline that must recognise unusual typefaces or handwriting.

The client browser version used by the end user.

Why it fails: Browser version affects only the client rendering the results, never the server-side embedding or similarity computation. It is tempting because front-end compatibility feels connected to search behaviour, and browser choice is correct when diagnosing display or JavaScript issues in a web application.

Bypass security reviews if the application is intended for internal enterprise employees only.

Why it fails: Internal-only audiences still require the same responsible AI review, since fairness and safety harms affect employees and the organisation's compliance posture identically. Skipping reviews is tempting when data sensitivity seems lower, but security review scope depends on data classification and regulatory obligations, not audience location.

Remove all system prompts to allow the model complete autonomy during evaluation runs.

Why it fails: Removing system prompts strips the safety instructions and grounding that Azure AI Foundry evaluations rely on, so fairness and safety metrics cannot be measured against intended behaviour. System prompts are legitimately varied when testing prompt-injection resilience or comparing prompt variants, not deleted for baseline risk assessment.

Hardcode responses for all possible user inputs to eliminate model non-determinism entirely.

Why it fails: Hardcoding every input produces a static lookup table, so the model's actual generative behaviour is never exercised and no fairness or safety signal is gathered. Deterministic fixtures are genuinely useful for regression-testing evaluation pipelines themselves, where reproducible outputs matter more than model behaviour.

MP3

Why it fails: MP3 is an audio codec, not an image format, so Azure AI Vision cannot analyse it. It tempts because the question lists file formats and MP3 is a familiar media type. Supported image formats include JPEG, PNG, GIF and BMP; audio belongs to Speech services.

MKV

Why it fails: MKV is a video container, not an image format, so Azure AI Vision's image analysis endpoint rejects it; the service accepts JPEG, PNG, GIF and BMP. It tempts because Vision's video analysis features do ingest video, but that is a separate capability from the image analysis operation the question asks about.

WAV

Why it fails: WAV is uncompressed audio, carrying no pixel data, so it cannot be submitted to the image analysis endpoint at all. It tempts because Azure AI Vision and Speech both sit in Azure AI Services, and Speech-to-text consumes WAV, but that is a different service and API surface.

Using random sentence selection without indexing

Why it fails: Random sentence selection discards semantic structure, so retrieved context is irrelevant and accuracy collapses while latency stays unpredictable. It is tempting as a cheap way to shrink context, and sampling would suit exploratory summarisation, but high-accuracy RAG requires indexed, embedding-based retrieval with reranking.

Disabling vector search entirely to rely solely on random string matching

Why it fails: Random string matching discards semantic similarity, so retrieval returns irrelevant chunks and accuracy collapses; vector search is the retrieval backbone of RAG. It is tempting because exact keyword matching is cheap and deterministic, and it would be correct for precise identifier or code lookups, not open-ended semantic queries.

Increase the confidence threshold parameter in the analyzeDocument request body to 0.99.

Why it fails: The confidence threshold only filters which extracted fields the response returns; raising it to 0.99 suppresses low-confidence results rather than improving the model's accuracy. It is tempting as a quick quality gate, which suits downstream validation logic, not raising the underlying extraction confidence of a custom template model.

Convert all training PDFs to grayscale and reduce their resolution to 72 DPI to speed up processing.

Why it fails: Grayscale conversion and 72 DPI reduction strip colour and detail the custom template model relies on to match field layouts, degrading extraction confidence further. It is tempting because smaller files process faster, which suits latency or throughput optimisation, not accuracy on poorly extracted fields.

Switch the model type from custom template to a prebuilt business card model.

Why it fails: A prebuilt business card model extracts a fixed schema of contact fields and cannot target the custom fields the template model was trained on, so those fields lose extraction entirely. It is tempting because prebuilt models need no training, which suits standard documents such as business cards, not bespoke field extraction.

Model Training Jobs

Why it fails: Model Training Jobs are a separate Azure Machine Learning workload, not a node type in a Prompt Flow DAG, whose components are inputs, tools, prompts, LLM nodes and outputs. It is tempting because training jobs do appear in ML pipelines, and would be correct when authoring a training pipeline rather than a prompt orchestration graph.

Data Labeling Projects

Why it fails: Data Labeling Projects belong to Azure Machine Learning's labelling workflow for annotating datasets, not to Prompt Flow's DAG execution model. Prompt Flow nodes are tools, LLM prompts, Python code and flow inputs/outputs. It is tempting because labelling feeds prompt engineering, but it is a separate service.

All documents from the same printer

Why it fails: Documents may originate from any source; the training set needs varied layouts and labelled fields, not uniform hardware. Same-printer origin would suit isolating scanner-specific artefacts during troubleshooting, but it narrows layout diversity and harms model generalisation.

At least 1,000 pages per model

Why it fails: Page volume is not a training requirement; Azure AI Document Intelligence custom models accept small labelled sets, and quality of labelled examples matters instead. The threshold applies to bulk document processing quotas, so it would fit capacity planning rather than training-set design.

Store unencrypted user authentication tokens directly inside the embedding vector metadata.

Why it fails: Embedding metadata is returned with search results and readable by any client querying the index, so storing raw tokens there exposes credentials across permission tiers. Tokens belong in a secure identity store. Vector metadata is intended for filterable attributes such as tenant or document identifiers used in security trimming.

Grant every user application admin privileges to bypass retrieval latency checks.

Why it fails: Admin privileges grant configuration and data access far beyond a user's permission tier, breaking the tiered isolation the scenario requires. Retrieval latency is governed by index design and query patterns, not privileges. Application admin rights suit platform operators managing the search service, not end users querying a RAG pipeline.

Disable managed identities and store plaintext connection strings in the application source code.

Why it fails: Disabling managed identities and embedding plaintext connection strings directly contradicts the compliance requirement, since credentials in source code are exposed to anyone with repository access and cannot be rotated centrally. It is tempting because connection strings do authenticate to Azure AI Search, but Microsoft Entra ID with managed identities is the supported credential-free mechanism for this scenario.

CPU utilization percentage

Why it fails: CPU utilisation is an infrastructure telemetry metric collected by Azure Monitor, not a semantic quality score. LLM-as-a-judge evaluators in Azure AI Foundry compute groundedness, relevance, fluency and coherence by prompting a model to assess generated text. CPU percentage would suit autoscale rules or performance profiling, never model evaluation.

DNS propagation delay

Why it fails: DNS propagation delay is a network-resolution timing measurement, which a language model cannot assess from prompt and response text. It is tempting because latency affects application behaviour, and would be correct when diagnosing name-resolution issues with tools such as dig or Azure DNS analytics.

Disk input/output operations per second (IOPS)

Why it fails: Disk IOPS measures storage throughput, not the semantic quality of generated text, so no LLM-as-a-judge evaluator can produce it. It is tempting because slow storage degrades inference throughput, and would be correct for virtual machine or Premium SSD performance analysis.

Train a new speech-to-text acoustic model for every email received.

Why it fails: Training a bespoke acoustic model per email is infeasible and irrelevant, since Azure AI Language processes written text rather than audio. It is tempting because custom speech models genuinely help when transcribing domain-specific audio, such as accented call-centre recordings, but multilingual email analysis needs language detection and translation instead.

Convert all email text into raw binary executable files before analysis.

Why it fails: Azure AI Language consumes text, so converting emails to binary executables destroys the linguistic content the service analyses. It is tempting as a naive data-serialisation step, and binary handling would suit scenarios such as packaging artefacts for malware scanning, not natural language processing.

Grant Contributor permissions to anonymous external users.

Why it fails: Anonymous external Contributor access removes authentication and least-privilege enforcement on the search service, directly violating Azure security benchmarks. It is tempting when sharing a demo index broadly, but Contributor should be scoped to authenticated principals; anonymous access belongs only to deliberately public, read-only content.

Expose admin API keys in client-side single-page applications for direct access.

Why it fails: Embedding admin API keys in client-side code exposes full control of the search service to anyone inspecting the page. It is tempting because it avoids building a backend proxy, yet admin keys must stay server-side in Key Vault; browsers should use query keys or Microsoft Entra ID tokens scoped to read.

Disable Azure Activity Logs to prevent administrative audit trails.

Why it fails: Disabling Activity Logs removes the audit trail that governance requires for tracking AI resource changes across teams. It is tempting when teams want to cut Log Analytics ingestion costs, but Activity Logs are retained at no cost for 90 days and underpin compliance reporting.

Assign the Owner role to all developers to streamline resource creation.

Why it fails: Owner grants full control including access management, so developers could alter RBAC and bypass governance guardrails; Contributor or custom roles suffice for resource creation. It is tempting as a quick way to unblock provisioning, but Owner is intended for a small set of subscription administrators.

Allowing the agent to execute any bash command directly on production servers without validation

Why it fails: Unvalidated bash on production servers grants the agent unrestricted destructive capability, bypassing approval and audit controls. Direct shell execution is intended for sandboxed developer tooling or disposable containers, never for line-of-business systems holding live data.

Disabling all logging and monitoring to maximize execution speed

Why it fails: Disabling logging removes the audit trail and telemetry needed to detect unsafe agent actions, so failures in external line-of-business calls go undiagnosed. It is tempting when latency budgets are tight, since telemetry adds overhead; however, throttling or sampling non-critical traces is the correct approach, never eliminating observability entirely.

Custom named entity recognition

Why it fails: Custom named entity recognition requires labelled training data and a trained model deployment, so it is not prebuilt. Prebuilt capabilities include sentiment analysis, key phrase extraction, language detection and prebuilt NER. Custom NER is correct when extracting domain-specific entities absent from the general model.

Custom text classification

Why it fails: Custom text classification requires labelled training data and a trained model deployment, so it is not prebuilt. It is tempting because it delivers tailored category labels for organisation-specific taxonomies, and would be the right choice when prebuilt categories cannot represent your domain's document types.

Custom summarization models

Why it fails: Custom summarization requires fine-tuning on your own document-summarisation dataset, so no prebuilt capability exists. It appeals when abstractive summaries must match a house style or domain vocabulary, and would be correct where prebuilt summarisation output quality is insufficient for specialised content.

Hardcoding every conditional execution path in procedural code

Why it fails: Agentic design relies on the model dynamically selecting and sequencing tool calls at runtime, so enumerating every branch in procedural code removes the reasoning loop that defines an agent. It is tempting because deterministic code suits fixed, auditable pipelines where no autonomous decision-making is required.

Executing single stateless prompt completions without memory

Why it fails: Agentic workflows maintain conversation and task state across turns, so stateless single completions discard the memory that lets an agent track goals and prior tool results. It is tempting because stateless calls suit independent, one-shot classification or summarisation tasks with no continuity requirement.

Latency

Why it fails: Latency measures response time, not whether generated claims are supported by retrieved source documents. It is tempting because latency is a standard production metric, and it would be correct when evaluating application performance or user experience rather than grounding fidelity.

Token cost

Why it fails: Token cost measures consumption and billing, not whether generated claims are supported by the retrieved sources. It is tempting because cost per query is a genuine operational metric for capacity planning, yet grounding evaluation instead measures faithfulness to context, such as groundedness scores and citation precision.

Model version number

Why it fails: Model version number identifies which weights and training cut-off produced the output; it says nothing about whether responses are anchored in retrieved evidence. It is tempting because versioning matters for reproducibility and regression testing, but grounding evaluation instead measures faithfulness to supplied context, such as citation accuracy and hallucination rate.

Zero-shot extraction of completely unseen document types without any training data

Why it fails: Custom Neural models require labelled training samples; zero-shot extraction of unseen document types is delivered by prebuilt models or the newer generative extraction capability, not custom neural training. It tempts because zero-shot promises training-free onboarding, which suits rapidly changing document sets where labelling is impractical.

Real-time voice-to-text transcription of document contents

Why it fails: Custom Neural models extract structured fields from documents; they process text and layout, not audio, so voice transcription is outside their capability. It is tempting because Document Intelligence handles multimodal input, and voice-to-text would be the correct choice when the source material is call recordings or meeting audio rather than scanned or digital documents.

Automatic language translation of extracted text into 100+ languages

Why it fails: Document Intelligence returns extracted text in its source language; translation is a separate Azure AI Translator service, so no Custom Neural model performs it. It tempts because multilingual document pipelines often pair extraction with translation, making translation feel like a natural extraction feature.