CCNA Implement Generative Ai And Agentic Solutions Questions — Page 2 of 3

MCQmedium

You are building an agent in Azure AI Foundry using a prompt flow. You need to ensure that the agent only uses company-approved documentation for its responses. Which feature should you implement to meet this requirement?

A.Enable prompt tuning

B.Implement system message constraints

C.Configure Grounding with data

D.Deploy a fine-tuned model

AnswerC

Grounding with data binds the model's responses to a specified index of company-approved documentation, retrieving passages at query time rather than relying on parametric knowledge. This directly satisfies the constraint that responses draw only from approved sources, since ungrounded generation could surface arbitrary content.

Why this answer

Grounding with data (e.g., Azure AI Search index, Azure Blob, or other approved data sources) constrains the model's responses to a curated knowledge base, ensuring the agent only answers from company-approved documentation. This is the standard RAG pattern in Azure AI Foundry and directly satisfies the 'only approved documentation' requirement.

Exam trap

AI-103 often tests the confusion between grounding (retrieval-based restriction to approved data) and fine-tuning (behavior/style adaptation) — candidates pick fine-tuning thinking it 'teaches' the model company data, but fine-tuning does not provide verifiable, updatable grounding.

How to eliminate wrong answers

Option A is wrong because prompt tuning adjusts the prompt template/parameters but does not restrict the model's knowledge source — the model can still hallucinate or use pretrained knowledge. Option B is wrong because system message constraints are soft instructions the model may ignore and do not enforce a data boundary. Option D is wrong because fine-tuning bakes in behavior/style but does not guarantee the model only cites approved documents, and it is expensive and slow to update when docs change.

Practice this question →

Multi-Selecthard

You are configuring tool integration for an agent. Which THREE aspects must be clearly defined in the tool definition for the agent to correctly use it?

Select 3 answers

A.The tool's description, explaining what it does and when to call it.

B.The total number of requests allowed per hour.

C.The authentication credentials (hardcoded).

D.The tool's name.

E.The JSON schema for the function arguments.

AnswersA, D, E

The description tells the agent what the tool does and when to invoke it, enabling correct tool selection among available options. Without a clear description, the agent cannot reliably decide when calling the tool is appropriate.

Why this answer

Option A is correct because the tool's description tells the agent what the tool does and, critically, when it should be invoked, which guides the model's decision to call it. Option D is correct because the tool's name is the identifier the agent uses to reference and invoke the specific function in its tool-call output. Option E is correct because the JSON schema for the function arguments defines the exact parameter names, types, and required fields the agent must supply, ensuring valid, parseable arguments.

Option B is not required in the tool definition; rate limiting is an operational/policy concern handled outside the tool's schema. Option C is wrong because hardcoding authentication credentials in the tool definition is insecure and unnecessary—credentials should be managed via secure configuration, not embedded in the tool spec.

Exam trap

AI-103 often tests whether candidates include operational metadata (rate limits, credentials) in the tool definition; the trap is confusing runtime configuration with the model-facing contract of name, description, and argument schema.

Practice this question →

MCQmedium

You are integrating Azure OpenAI into an enterprise application. You need to prevent prompt injection attacks where users attempt to override the system instructions. Which approach provides the most robust defense?

A.Implement an input guardrail using Azure AI Content Safety to detect and block jailbreak attempts before they reach the model.

B.Set the model frequency penalty to 2.0 to penalize repeated malicious phrases.

C.Append 'Ignore previous instructions' at the end of every user message.

D.Encode all user input in Base64 before sending it to the model.

AnswerA

Azure AI Content Safety's prompt shields detect jailbreak and indirect injection patterns in user input, blocking them before inference. This satisfies the requirement for the most robust defence, because filtering occurs outside the model, so attackers cannot override system instructions through crafted prompts.

Why this answer

Azure AI Content Safety's Prompt Shields (jailbreak detection) is purpose-built to detect and block prompt injection and jailbreak attempts at the input boundary before they reach the model. This provides a robust, model-agnostic defense layer that is maintained and updated by Microsoft against emerging attack patterns. Input filtering is the recommended first line of defense in Microsoft's defense-in-depth guidance for LLM applications.

Exam trap

AI-103 often tests the misconception that model parameters (frequency/presence penalty) or encoding tricks defend against prompt injection, when the correct answer is a dedicated input guardrail like Azure AI Content Safety Prompt Shields.

How to eliminate wrong answers

Option B is wrong because frequency penalty only discourages token repetition in the model's output — it has no effect on detecting or blocking adversarial input instructions. Option C is wrong because appending 'Ignore previous instructions' actually amplifies the injection risk and does not neutralize attacker-supplied overrides. Option D is wrong because Base64 encoding is trivially reversible and does not prevent the model from decoding and acting on malicious instructions; it obscures but does not defend.

Practice this question →

MCQmedium

You are building a chat application with Azure OpenAI. To improve perceived latency for users, you want to stream the model's response token-by-token to the client interface. Which API parameter or client SDK feature should you enable?

A.Set max_tokens to 1

B.Configure Azure AI Search with hybrid search

C.Enable semantic caching

D.Enable streaming in the chat completion request (stream=True)

AnswerD

Setting `stream=True` makes the chat completions endpoint return server-sent events, emitting each token as it is generated rather than buffering the full completion. This directly satisfies the stem's token-by-token requirement, cutting perceived latency because the client renders partial output immediately. Microsoft Entra ID authentication is unaffected by this parameter.

Why this answer

Setting stream=True in the chat completion request enables server-sent events (SSE) that deliver tokens incrementally as the model generates them, dramatically improving perceived latency. The client SDKs expose this as a streaming iterator or callback, letting the UI render partial responses immediately.

Exam trap

AI-103 often tests whether candidates conflate latency-reduction techniques (caching, smaller max_tokens) with streaming, so they pick an option that changes output content or retrieval rather than enabling incremental token delivery.

How to eliminate wrong answers

Option A is wrong because max_tokens=1 limits output to a single token, which truncates the response rather than streaming it. Option B is wrong because hybrid search is a retrieval technique for grounding, unrelated to response streaming. Option C is wrong because semantic caching reuses prior responses to reduce cost/latency but does not stream tokens.

Practice this question →

Multi-Selectmedium

Which TWO actions should you take to ensure your agentic solution is 'Responsible'?

Select 2 answers

A.Enable Content Safety filters for all inputs and outputs.

B.Disable all logging to protect user privacy.

C.Provide transparent disclosures to users that they are interacting with an AI agent.

D.Set the model temperature to 1.0 to increase diversity.

E.Allow the agent to access the public internet without restrictions.

AnswersA, C

Content Safety filters screen prompts and completions for harmful categories such as violence, hate and self-harm, blocking unsafe agent behaviour at runtime. This enforces the safety pillar of Microsoft's Responsible AI standard across every input and output the agent processes.

Why this answer

Option A is correct because enabling Content Safety filters on all inputs and outputs is a core responsible-AI control that detects and blocks harmful content categories (hate, violence, sexual, self-harm) before they reach or leave the agent, directly mitigating safety risks. Option C is correct because transparent disclosure that users are interacting with an AI agent upholds the responsibility principles of transparency and accountability, ensuring users are informed and can calibrate their trust appropriately. Option B is not correct because disabling all logging removes auditability and traceability, which are essential for monitoring misuse, debugging, and accountability, and privacy is better handled through data minimization and redaction rather than eliminating logs.

Option D is not correct because raising temperature to 1.0 increases randomness and unpredictability, which undermines reliability and safety rather than improving responsibility. Option E is not correct because unrestricted public internet access expands the attack surface and risks unsafe or unverified content, so access should be governed by allowlists, grounding, and policy controls.

Exam trap

AI-103 often tests the misconception that 'privacy' means disabling logging — candidates must recognize that Responsible AI requires both safety filtering and transparency, while logging is a governance requirement, not a violation.

Practice this question →

MCQmedium

You are deploying an LLM in Azure AI Foundry and want to restrict access to the endpoint to a specific virtual network. What should you configure?

A.Azure AD Conditional Access

B.Firewall Rule on the Model

C.Private Endpoint

D.Managed Identity

AnswerC

A private endpoint creates a private IP address for the Azure AI Foundry resource inside your virtual network, so traffic never traverses the public internet. This satisfies the requirement to restrict endpoint access to a specific virtual network, unlike service endpoints or firewall rules, which still permit public connectivity.

Why this answer

A private endpoint creates a private IP address for the Azure AI Foundry endpoint within your virtual network, ensuring traffic never traverses the public internet. This restricts access to only resources within that VNet. It is the standard Azure PaaS networking feature for private connectivity.

Exam trap

AI-103 often tests the confusion between identity-based access control (Conditional Access, Managed Identity) and network-based isolation (Private Endpoint), leading candidates to pick identity solutions for network restriction requirements.

How to eliminate wrong answers

Option A is wrong because Azure AD Conditional Access controls user access based on identity and device conditions, not network-level isolation of the endpoint. Option B is wrong because there is no 'Firewall Rule on the Model' feature; firewall rules apply to the Azure AI Foundry resource or its network settings, but a private endpoint is the correct mechanism for VNet restriction. Option D is wrong because Managed Identity provides authentication for the app to access other resources, not network restriction.

Practice this question →

MCQhard

You are building an agentic solution in Microsoft Foundry where a planner agent delegates subtasks to several specialist agents. During testing, the planner repeatedly loses track of completed subtasks and re-delegates work, causing duplicate API calls and inflated costs. You need the planner to maintain reliable state across turns without exceeding the context window. What should you implement?

A.Convert the planner into a single monolithic agent that performs all subtasks sequentially in one prompt.

B.Implement a shared thread or state store where each subtask's status is recorded, and give the planner a tool to read and update that state between delegations.

C.Raise the planner's temperature so it explores alternative delegation orders and avoids repeating identical calls.

D.Increase the model's context window by switching to a larger deployment and append the full conversation history to every planner request.

AnswerB

Externalizing task state into a shared store gives the planner an authoritative record of what has been completed and what remains, independent of the context window. A read-and-update tool lets the planner consult status before delegating, eliminating duplicate work and keeping prompts compact because only relevant state is retrieved.

Why this answer

Persisting subtask status in a shared store and exposing it to the planner through read and update tools provides durable, queryable state that survives across turns without consuming context. The planner checks status before delegating, so completed work is not repeated, and prompts stay small because only the relevant state is retrieved.

Exam trap

The trap here is assuming that a larger context window or higher temperature fixes repeated delegation, when the real gap is the absence of an external, authoritative task-state record.

Practice this question →

Multi-Selectmedium

You are optimizing an Azure OpenAI deployment in Azure AI Foundry for high-throughput batch processing. Which TWO strategies or configurations should you consider? (Choose TWO)

Select 2 answers

A.Azure OpenAI Batch API for asynchronous high-volume jobs at reduced costs

B.Disabling SSL certificate validation in the client SDK

C.Provisioned Throughput Units (PTUs) for guaranteed model capacity and predictable latency

D.Setting model max_tokens to 1

E.Routing all traffic through public developer local workstations

AnswersA, C

The Batch API accepts large asynchronous jobs at roughly 50% lower cost with separate quota, so it does not compete with real-time traffic. It satisfies the high-throughput batch processing requirement by decoupling bulk workloads from interactive deployments.

Why this answer

Option A is correct because the Azure OpenAI Batch API is purpose-built for asynchronous, high-volume workloads, processing requests in the background with a separate quota and offering roughly 50% lower cost than synchronous calls, which directly suits high-throughput batch processing. Option C is correct because Provisioned Throughput Units (PTUs) reserve dedicated model capacity for a deployment, guaranteeing consistent throughput and predictable latency rather than being throttled by shared pay-as-you-go quota, which is essential for sustained high-volume jobs. Option B is wrong because disabling SSL certificate validation weakens transport security and is never a valid optimization strategy.

Option D is wrong because setting max_tokens to 1 would truncate responses to a single token, breaking output quality rather than improving throughput. Option E is wrong because routing production traffic through public developer workstations is insecure, unreliable, and not a supported architecture for scaling Azure OpenAI workloads.

Exam trap

AI-103 often tests the confusion between cost-optimized asynchronous batch processing (Batch API) and latency-guaranteed dedicated capacity (PTUs) — candidates must recognize both as valid high-throughput strategies while rejecting security-weakening or nonsensical options.

Practice this question →

MCQhard

You are implementing a function-calling flow in an Azure AI Foundry agent. The agent must call a get_order_status function, but during testing it sometimes invents an order ID and calls the function with a fabricated value instead of asking the user. You need the agent to request the missing order ID from the user before invoking the function. What should you do?

A.Mark the order_id parameter as required in the function's JSON schema and provide a clear parameter description, then let the model request it when absent.

B.Set the agent's temperature to 0 so the model becomes deterministic and stops fabricating order IDs.

C.Wrap the function call in a try/catch that retries with a random order ID when the first call fails.

D.Add a system message instructing the model to never guess values, and remove the order_id parameter from the function schema.

AnswerA

The function's JSON schema is the contract the model uses to decide whether it has enough information to call the tool. Declaring order_id as required with a descriptive field tells the model the call is incomplete without it, so the model asks the user instead of hallucinating a value. This is the supported mechanism for enforcing required arguments in function calling.

Why this answer

In function calling, the JSON schema of the tool defines what the model must supply. Declaring order_id as required with a descriptive field gives the model the signal it needs to ask the user for the missing value instead of inventing one, which is the correct fix for the observed behavior.

Exam trap

The trap here is assuming that prompt instructions or low temperature can substitute for schema-level enforcement of required function parameters.

Practice this question →

MCQmedium

You are designing a generative AI application that processes user uploaded documents. You must ensure that Personally Identifiable Information (PII) such as Social Security numbers are automatically redacted before the text is sent to the Azure OpenAI model. Which service should you integrate into your pipeline?

A.Azure AI Language service (PII detection and redaction)

B.Azure AI Translator

C.Azure AI Vision OCR

D.Azure Monitor Application Insights

AnswerA

Azure AI Language's PII detection identifies and redacts entities such as Social Security numbers before text reaches the model, satisfying the requirement that sensitive data never leaves your pipeline unredacted. It provides a prebuilt, purpose-built redaction capability rather than relying on the model itself to avoid echoing PII.

Why this answer

Azure AI Language provides a prebuilt PII detection and redaction capability that identifies entities like Social Security numbers, credit card numbers, and names, and can mask or redact them in text. Integrating it into the pipeline before sending text to Azure OpenAI ensures sensitive data never reaches the model. This is the purpose-built service for the requirement.

Exam trap

AI-103 often tests the confusion between services that process text (Translator, OCR) and services that specifically detect and redact PII (Azure AI Language), or between observability tools and data protection tools.

How to eliminate wrong answers

Option B is wrong because Azure AI Translator handles language translation, not PII detection or redaction. Option C is wrong because Azure AI Vision OCR extracts text from images but does not identify or redact PII within that text. Option D is wrong because Azure Monitor Application Insights is an observability and telemetry service, not a data redaction tool.

Practice this question →

MCQhard

You are implementing an agentic workflow where an agent executes tools that modify corporate data. To adhere to Responsible AI principles, you must ensure a human reviewer approves sensitive tool actions before they are executed. What design pattern should you implement in Azure AI Agent Service?

A.Fully autonomous agent loop with max iterations set to 50

B.Human-in-the-loop (HITL) approval workflow for tool execution

C.Azure API Management rate limiting policy

D.Asynchronous event grid notification after tool execution

AnswerB

Human-in-the-loop approval intercepts tool calls before execution, pausing the agent so a reviewer can authorise sensitive data modifications. This directly satisfies the Responsible AI constraint that a human must approve actions prior to execution, rather than auditing them afterwards.

Why this answer

Human-in-the-loop (HITL) approval inserts a human review step before sensitive tool actions execute, satisfying Responsible AI requirements for oversight of consequential operations. In Azure AI Agent Service, this is implemented by pausing the agent's tool call, surfacing it for approval (via UI, API, or Logic Apps), and only proceeding on explicit human consent. This preserves accountability and prevents autonomous harmful actions.

Exam trap

AI-103 often tests the confusion between post-execution notification/auditing and pre-execution human approval — candidates must recognize that Responsible AI requires gating sensitive actions before they occur, not just logging them afterward.

How to eliminate wrong answers

Option A is wrong because a fully autonomous loop with high max iterations removes human oversight entirely, directly violating the Responsible AI principle of human accountability for sensitive actions. Option C is wrong because API Management rate limiting controls traffic volume, not action approval — it does not gate individual tool executions on human consent. Option D is wrong because asynchronous Event Grid notification occurs after execution, which is post-hoc auditing, not pre-execution approval; the sensitive action would already have modified corporate data.

Practice this question →

MCQeasy

Which of the following is a core principle of Responsible AI in Azure AI Foundry?

A.Bypassing all safety filters.

B.Maximizing cost savings at any cost.

C.Forcing the model to agree with the user.

D.Transparency and explainability.

AnswerD

Transparency and explainability directly satisfy Responsible AI's requirement that stakeholders understand how models reach decisions. In Azure AI Foundry, this principle underpins model cards, evaluation reports and interpretability tooling, ensuring systems remain accountable and their behaviour auditable throughout deployment.

Why this answer

Transparency and explainability is a core principle of Responsible AI in Azure AI Foundry, ensuring that AI systems are understandable, their decisions can be explained, and users can comprehend how outputs are generated. This aligns with Microsoft's Responsible AI principles: fairness, reliability & safety, privacy & security, inclusiveness, transparency, and accountability. The other options describe anti-patterns that violate Responsible AI.

Exam trap

AI-103 often tests the confusion between operational goals (cost savings) or anti-patterns (bypassing filters) and the actual Responsible AI principles, with transparency and explainability being the correct core principle.

How to eliminate wrong answers

Option A (Bypassing all safety filters) is wrong because Responsible AI requires safety filters and content moderation to prevent harmful outputs; bypassing them is a violation, not a principle. Option B (Maximizing cost savings at any cost) is wrong because cost optimization is an operational goal, not a Responsible AI principle, and pursuing it 'at any cost' would compromise safety and ethics. Option C (Forcing the model to agree with the user) is wrong because this describes sycophancy, which undermines truthfulness and reliability — Responsible AI promotes honest, calibrated responses, not forced agreement.

Practice this question →

MCQeasy

In Azure AI Foundry, which tool would you use to measure the quality of your RAG application against a golden dataset?

A.Evaluation

B.Model Catalog

C.Deployment

D.Prompt Flow Tracing

AnswerA

Evaluation in Azure AI Foundry runs automated metrics — groundedness, relevance, retrieval score — comparing your RAG application's responses against a golden dataset, directly satisfying the requirement to measure quality. It provides repeatable, quantitative scoring rather than manual inspection, making regression testing and iterative improvement possible.

Why this answer

The Evaluation tool in Azure AI Foundry is designed to measure the quality of generative AI applications, including RAG systems, against a golden dataset using metrics such as groundedness, relevance, coherence, and fluency. It provides both built-in and custom evaluators, making it the correct choice for quality measurement. Model Catalog, Deployment, and Prompt Flow Tracing serve different purposes.

Exam trap

AI-103 often tests the distinction between observability (Prompt Flow Tracing) and quality measurement (Evaluation) — candidates pick Tracing because it sounds like it measures quality, but it only shows execution details.

How to eliminate wrong answers

Option B is wrong because Model Catalog is a repository for discovering and provisioning foundation models, not for evaluating application quality. Option C is wrong because Deployment is the process of provisioning a model or agent endpoint, not measuring quality. Option D is wrong because Prompt Flow Tracing provides observability into execution flow and latency, but it does not compute quality metrics against a golden dataset.

Practice this question →

MCQhard

You are building an advanced agentic RAG solution. When a user asks a complex question, the agent needs to generate multiple search queries, execute them in parallel against Azure AI Search, synthesize the findings, and then formulate a final answer. Which agent pattern are you implementing?

A.Model fine-tuning

B.Single-shot keyword extraction

C.Static prompt templating

D.Query decomposition and parallel retrieval

AnswerD

The agent splits the complex question into multiple sub-queries, dispatches them concurrently to Azure AI Search, then synthesises results before answering. This matches the stem's parallel execution and synthesis requirements, distinguishing it from single-query or sequential patterns.

Why this answer

Query decomposition and parallel retrieval is an agentic RAG pattern where the agent breaks a complex question into multiple sub-queries, executes them concurrently against Azure AI Search, and then synthesizes the results into a final answer. This pattern improves recall and handles multi-hop reasoning. It is distinct from fine-tuning, keyword extraction, or static templating, which do not involve dynamic query generation and parallel execution.

Exam trap

AI-103 often tests the confusion between simple RAG and agentic RAG patterns, where candidates may pick fine-tuning or static templating instead of query decomposition and parallel retrieval.

How to eliminate wrong answers

Option A is wrong because model fine-tuning adjusts model weights for style or domain adaptation and does not generate or execute multiple search queries. Option B is wrong because single-shot keyword extraction produces one set of keywords from the query and does not decompose or parallelize retrieval. Option C is wrong because static prompt templating uses fixed prompts without dynamic query generation or parallel execution.

Practice this question →

MCQmedium

You are developing an Azure AI Search index for a RAG application. You need to ensure that the search results include semantic relevance scores to improve the quality of the model's grounding. Which feature must you enable?

A.Use Custom Analyzers

B.Enable Knowledge Store

C.Enable Semantic Ranker on the search service

D.Enable Hybrid Search with vectorization

AnswerC

Semantic Ranker adds a reranking stage that returns semantic relevance scores alongside results, directly satisfying the stem's requirement for grounding quality. It operates on top of the existing index without altering the base scoring profile, so enabling it on the search service is sufficient.

Why this answer

Semantic Ranker is the Azure AI Search feature that applies a Microsoft-hosted language model to re-rank the top results from an initial retrieval pass, producing semantic relevance scores (semantic captions and answers) that improve grounding quality for RAG. Enabling it on the search service (Standard tier or higher) and then configuring it on the index/query is what surfaces the semantic score. Without Semantic Ranker, results are ranked only by BM25 or vector similarity, not by deep semantic understanding.

Exam trap

AI-103 often tests the misconception that hybrid search or vectorization alone produces semantic scores — candidates must recognize that Semantic Ranker is a distinct, separately enabled feature that generates the semantic relevance score.

How to eliminate wrong answers

Option A is wrong because Custom Analyzers only control lexical tokenization, stemming, and stop-word handling at index time — they improve keyword matching but do not produce semantic relevance scores. Option B is wrong because Knowledge Store is a feature that persists enriched content (from AI enrichment skillsets) into Azure Storage for downstream analytics; it does not rank or score query results. Option D is wrong because Hybrid Search with vectorization combines keyword and vector queries to improve recall, but the ranking is still based on BM25 and vector similarity — it does not generate semantic relevance scores unless Semantic Ranker is also enabled.

Practice this question →

MCQhard

You need to ensure that an LLM-based agent in your application follows a specific output schema (JSON) for downstream processing. What is the most reliable way to enforce this?

A.Use a few-shot prompt with JSON examples

B.Use a custom parser in Prompt Flow

C.Configure the response_format property to JSON

D.Set the Stop Sequences parameter

AnswerC

Setting response_format to JSON constrains the model's decoding to emit valid JSON conforming to a supplied schema, giving deterministic structure for downstream parsing. Prompt instructions alone cannot guarantee schema compliance, so this API-level constraint is the reliable mechanism.

Why this answer

Configuring the response_format property to JSON (or json_schema for structured outputs) instructs the model at the API level to emit valid JSON conforming to the schema, which is enforced by constrained decoding rather than relying on prompt compliance. This is the most reliable enforcement because it operates at the model's token-generation layer, not on post-hoc parsing.

Exam trap

AI-103 often tests the confusion between response_format json_object (valid JSON only) and json_schema strict mode (schema-guaranteed), luring candidates toward prompt-based approaches that cannot guarantee structure.

How to eliminate wrong answers

Option A is wrong because few-shot examples only bias the model probabilistically; the model can still emit malformed JSON or extra prose, so it is not a guarantee. Option B is wrong because a custom parser in Prompt Flow only detects and possibly repairs invalid output after generation, which is reactive and cannot prevent schema violations. Option D is wrong because Stop Sequences merely halt generation at a token sequence; they do not constrain the structure or validity of the JSON produced.

Practice this question →

MCQmedium

You are configuring a code interpreter tool for an AI agent in Azure AI Agent Service. The agent needs to analyze a CSV dataset uploaded by a user. How does the agent execute this task securely?

A.The agent compiles the CSV data into C# binaries and runs them on the host Azure App Service instance.

B.The agent sends the raw CSV data to an external public third-party execution API.

C.The agent generates Python code to analyze the CSV and executes it inside a secure, isolated sandbox environment managed by the service.

D.The agent translates the CSV data into SQL queries and executes them directly against the primary production database.

AnswerC

The service runs generated Python inside a managed, isolated sandbox with no network or host access, so uploaded CSV data is analysed without exposing the platform. This sandboxed execution model is what makes code interpreter safe for untrusted user datasets.

Why this answer

The code interpreter tool in Azure AI Agent Service generates and runs Python code in a secure, isolated sandbox managed by the service. This allows the agent to analyze uploaded CSV data without exposing the host environment or production systems.

Exam trap

AI-103 often tests whether candidates understand that code interpreter execution is sandboxed and managed, not run on the host or against production databases, and not outsourced to public third-party APIs.

How to eliminate wrong answers

Option A is wrong because the agent does not compile CSV data into C# binaries or run them on the host App Service instance; that would be unsafe and is not how the tool works. Option B is wrong because sending raw CSV data to an external public third-party execution API would create data residency, privacy, and security risks and is not the native behavior. Option D is wrong because translating CSV data into SQL and executing it directly against the primary production database would be dangerous and is not how the code interpreter operates.

Practice this question →

Multi-Selecthard

You are implementing indirect prompt injection defenses in a RAG application where documents are ingested from public web pages. Which THREE mitigation strategies should you deploy? (Choose THREE)

Select 3 answers

A.Use strict structural delimiters (like XML tags) to isolate retrieved context from system instructions

B.Trust all incoming web page text unconditionally without inspection

C.Disable all content moderation filters to maximize processing speed

D.Implement output validation filters to check model completions for unauthorized actions or exfiltration attempts

E.Enable Prompt Shields for indirect prompt injection in Azure AI Content Safety

AnswersA, D, E

Wrapping retrieved documents in strict structural delimiters such as XML tags separates untrusted web content from system instructions, so injected text inside a document is treated as data rather than executable instruction. This directly mitigates indirect prompt injection during RAG ingestion from public pages.

Why this answer

Option A is correct because strict structural delimiters such as XML tags (e.g., <context>...</context>) create a clear boundary between untrusted retrieved document text and trusted system instructions, making it harder for injected instructions inside web content to be interpreted as authoritative commands. Option D is correct because output validation filters inspect model completions for unauthorized actions, data exfiltration patterns, or policy violations, providing a defense-in-depth control that catches injection effects even if the input-side isolation fails. Option E is correct because Azure AI Content Safety's Prompt Shields feature is specifically designed to detect both direct (user) and indirect (document) prompt injection attacks, including spotlighting techniques used in RAG ingestion pipelines.

Option B is incorrect because trusting all incoming web page text unconditionally is the exact vulnerability that enables indirect prompt injection, since public pages can contain adversarial instructions. Option C is incorrect because disabling content moderation filters removes a key safety layer and increases the risk that malicious or harmful injected content is processed and acted upon.

Exam trap

AI-103 often tests the misconception that a single control (e.g., delimiters alone) suffices for indirect prompt injection, when the correct answer requires multiple layered mitigations including detection and output validation.

Practice this question →

MCQeasy

You are designing a generative AI solution in Azure AI Foundry. You need to ensure that user data sent to Azure OpenAI is not used to train Microsoft's foundational models. What is Microsoft's default data privacy policy for Azure OpenAI?

A.Customer data is stored in public Azure storage accounts

B.Customer data is not used to train foundation models by default

C.Customer data is automatically published to public hugging face repositories

D.Customer data is used for model training unless you opt out by submitting a support ticket

AnswerB

Azure OpenAI does not use customer prompts or completions to train, retrain, or improve Microsoft's foundation models by default; data is used only to provide the requested service. This default satisfies the stem's requirement that user data sent to Azure OpenAI must not train Microsoft's foundational models.

Why this answer

Microsoft's default policy for Azure OpenAI is that customer data (prompts and completions) is not used to train foundation models and is not shared with model providers. Data is processed only for the requested inference and retained per the service's data retention terms, not for training.

Exam trap

AI-103 often tests the misconception that Azure OpenAI trains on customer data unless you opt out, when in fact no-training is the default and opt-out is not required.

How to eliminate wrong answers

Option A is wrong because customer data is not stored in public Azure storage accounts; it is processed in the service's isolated environment with encryption. Option C is wrong because Microsoft does not publish customer data to public repositories like Hugging Face; that would be a catastrophic privacy breach. Option D is wrong because the default is already opt-out of training—there is no need to submit a support ticket to prevent training, as training on customer data is not the default behavior.

Practice this question →

Multi-Selectmedium

You are designing an agentic workflow in Prompt Flow. Which TWO components are required to define a tool-based agent? (Choose two)

Select 2 answers

A.A LLM to act as the agent brain

B.Tool definition (OpenAPI spec or Python function)

C.A SQL Database

D.A Power Automate cloud flow

E.An Azure Container Registry

AnswersA, B

The LLM acts as the agent brain, interpreting input and deciding which tools to invoke. It is required to define a tool-based agent in Prompt Flow, providing the reasoning step that selects tools and produces the final response.

Why this answer

Option A is correct because a tool-based agent in Prompt Flow requires an LLM to serve as the agent's reasoning brain, deciding which tools to invoke and how to interpret their outputs. Option B is correct because the agent must have tool definitions—provided as an OpenAPI specification or a Python function—so the LLM knows the available actions, their parameters, and how to call them. Option C is incorrect because a SQL Database is merely a possible backend a tool might query; it is not a required component of the agent definition.

Option D is incorrect because a Power Automate cloud flow is an optional integration, not a mandatory element for defining a tool-based agent. Option E is incorrect because Azure Container Registry is only relevant for storing container images used in custom environments, not for defining the agent itself.

Exam trap

AI-103 often tests the misconception that additional infrastructure like databases or Power Automate is required for agents, when only LLM and tool definitions are essential.

Practice this question →

Multi-Selecthard

Which THREE of the following are best practices for Responsible AI when using Generative AI solutions?

Select 3 answers

A.Removing all system instructions to maximize creativity

B.Implementing content safety filters

C.Collecting all user PII for model training

D.Maintaining human-in-the-loop oversight

E.Providing transparency to users that they are interacting with an AI

AnswersB, D, E

Content safety filters classify and block harmful categories such as violence, hate, sexual content and self-harm in both prompts and completions. This directly satisfies the Responsible AI requirement by preventing harmful generated output, complementing other measures like transparency notes and human oversight rather than replacing them.

Why this answer

Option B is correct because implementing content safety filters (such as Azure AI Content Safety categories for hate, violence, sexual, and self-harm content) helps prevent generative models from producing or surfacing harmful, offensive, or disallowed output, which is a core Responsible AI safeguard. Option D is correct because maintaining human-in-the-loop oversight ensures that consequential AI-generated decisions or outputs are reviewed and validated by a person before action, reducing risk of unchecked errors or misuse. Option E is correct because providing transparency to users that they are interacting with an AI (for example, disclosing that content is AI-generated or that they are chatting with a bot) upholds the Responsible AI principles of transparency and accountability, helping users calibrate trust.

Option A does not belong because removing all system instructions degrades safety guardrails and controllability rather than improving responsible use, and Option C does not belong because collecting all user PII for model training violates data minimization, privacy, and consent principles central to Responsible AI.

Exam trap

The trap is that distractor options sound like they improve model quality or personalization (more creativity, more training data), but AI-103 expects you to recognize they violate Responsible AI principles of safety, privacy, and transparency.

Practice this question →

MCQhard

Your team is implementing 'Human-in-the-loop' (HITL) for an agent that performs account updates. Which mechanism should you use to pause the agent and wait for approval?

A.Set a long timeout in the API call.

B.Increase the model's 'stop_sequences'.

C.Use an infinite loop in Python.

D.Use a Prompt Flow 'Pause' node or custom state management logic.

AnswerD

A Prompt Flow 'Pause' node or custom state management suspends agent execution mid-run, persisting state until an approval signal resumes it. This satisfies the HITL constraint of halting account updates before they commit, rather than logging or post-hoc review.

Why this answer

Human-in-the-loop requires the agent to suspend execution, persist its state, and resume only after an external approval signal. In Azure Prompt Flow this is implemented with a Pause node (or equivalent custom state management) that halts the flow and waits for an external event or API call to continue. This preserves the agent's context and prevents the account update from executing until a human explicitly approves it.

Exam trap

AI-103 often tests whether candidates understand that HITL requires explicit state persistence and an approval gate — the trap is choosing a timeout or model parameter that merely delays execution instead of truly pausing it.

How to eliminate wrong answers

Option A is wrong because a long API timeout only delays failure — it does not pause the workflow, persist state, or provide an approval gate; the call will eventually time out and the operation will fail. Option B is wrong because stop_sequences controls where the model stops generating tokens; it has nothing to do with pausing a workflow or waiting for human input. Option C is wrong because an infinite loop blocks the worker thread, consumes compute, and provides no mechanism to receive or act on an approval signal.

Practice this question →

MCQhard

You are performing Retrieval-Augmented Generation. You need to ensure the retrieved data includes metadata for filtering. Where should this metadata be defined?

A.Environment variables

B.Prompt Flow input schema

C.System message content

D.Azure AI Search Index Fields

AnswerD

Filterable metadata must be declared as fields in the Azure AI Search index schema, since filtering operates on index fields rather than on source documents or prompt content. Defining metadata there enables the filter expressions RAG queries require.

Why this answer

In a RAG architecture, metadata used for filtering (such as category, source, date, or access level) must be defined as fields in the Azure AI Search index schema so that queries can apply OData filter expressions against them. The index is the authoritative store of both vector/content data and its associated filterable attributes.

Exam trap

The trap is assuming metadata can be injected via prompts or environment variables; the exam tests whether you know that filterable metadata must live in the search index schema itself.

How to eliminate wrong answers

Option A is wrong because environment variables hold configuration secrets and connection strings, not per-document metadata used for query filtering. Option B is wrong because a Prompt Flow input schema defines the shape of inputs passed into a flow, not the searchable metadata stored alongside indexed documents. Option C is wrong because the system message is prompt text that shapes model behavior; it cannot be queried or filtered by Azure AI Search.

Practice this question →

MCQeasy

You are deploying a model in Azure AI Foundry. You need to ensure that the model endpoint is protected by a virtual network. Which configuration should you use?

A.Enable public internet access with IP firewall rules

B.Enable Managed Identity on the endpoint

C.Deploy a dedicated Azure Application Gateway

D.Configure a Private Endpoint for the AI resource

AnswerD

A Private Endpoint assigns a private IP from your virtual network to the Azure AI resource, so traffic to the endpoint never traverses the public internet. This satisfies the requirement that the model endpoint be protected by a virtual network.

Why this answer

Configuring a Private Endpoint for the AI resource is correct because Azure Private Link creates a private IP address within your virtual network for the Azure AI Foundry resource, ensuring all traffic to the model endpoint stays on the Microsoft backbone and never traverses the public internet. This is the standard mechanism for VNet-protected PaaS endpoints in Azure.

Exam trap

AI-103 often tests the confusion between identity features (Managed Identity) and network features (Private Endpoint), or the belief that IP firewall rules constitute VNet protection — they do not.

How to eliminate wrong answers

Option A is wrong because enabling public internet access with IP firewall rules still exposes the endpoint publicly and does not satisfy the requirement that the endpoint be protected by a virtual network — it is a network-layer allowlist, not VNet isolation. Option B is wrong because Managed Identity provides authentication to Azure resources but does not provide network isolation; it is an identity feature, not a networking feature. Option C is wrong because an Application Gateway is a Layer 7 load balancer and WAF, not a mechanism for privately connecting to a PaaS endpoint — it does not create a private IP for the AI resource.

Practice this question →

100

Multi-Selecthard

You are troubleshooting an Azure OpenAI deployment in Azure AI Foundry where agents are failing to complete tasks due to excessive timeouts. Which THREE diagnostic steps should you take? (Choose three.)

Select 3 answers

A.Check if the tokens-per-minute (TPM) quota is throttling requests, causing queued delays.

B.Double the model temperature to 2.0 to accelerate reasoning speed.

C.Delete all vector indices to force local memory processing.

D.Inspect Application Insights telemetry to analyze execution duration per agent step and tool call latency.

E.Increase the client-side HTTP timeout threshold on the API request client.

AnswersA, D, E

Checking TPM quota directly addresses throttling, where exceeding the provisioned rate returns 429 responses and queues requests, inflating latency until agents time out. This satisfies the stem's excessive-timeout constraint by confirming whether rate limiting, rather than model or network faults, causes the delays.

Why this answer

Option A is correct because Azure OpenAI enforces tokens-per-minute (TPM) quotas per deployment; when requests exceed the quota, they are throttled with HTTP 429 responses and retried after a Retry-After delay, which manifests as queued latency and agent timeouts, so verifying TPM utilization and quota limits is a valid diagnostic step. Option D is correct because Application Insights integrated with Azure AI Foundry captures distributed traces of agent runs, including per-step durations, tool call latency, and dependency calls, letting you pinpoint exactly which step or tool is consuming the time budget. Option E is correct because the client-side HTTP timeout (for example, the timeout setting on the AzureOpenAI/OpenAI SDK client or HttpClient) may be shorter than the actual end-to-end agent execution time, so raising that threshold prevents premature client aborts while you investigate.

Option B is not appropriate because temperature controls randomness, not reasoning speed, and 2.0 is outside the supported range (0–2) and would degrade output quality rather than fix timeouts. Option C is not appropriate because deleting vector indices destroys the retrieval data agents depend on and does not accelerate processing; it would break RAG functionality instead of resolving latency.

Exam trap

AI-103 often tests whether candidates recognize that timeouts in agentic workflows are usually caused by throttling, insufficient observability, or client misconfiguration — not by model parameters like temperature.

Practice this question →

101

Multi-Selecthard

You are designing an advanced agentic solution in Azure AI Foundry that requires tool integration and state management. Which TWO practices should you implement to ensure robust agent reliability and security? (Choose two)

Select 2 answers

A.Implement human-in-the-loop confirmation steps before the agent executes high-impact or destructive transactional tool calls.

B.Validate and sanitize all parameters generated by the model before passing them into downstream enterprise tool APIs.

C.Disable all logging and telemetry to minimize latency during agent execution loops.

D.Grant the agent unrestricted administrative permissions to all corporate databases to maximize autonomous problem-solving.

E.Rely solely on the model's internal memory to maintain multi-session conversation state without external persistence.

AnswersA, B

Human-in-the-loop confirmation inserts a review gate before destructive or high-impact tool calls execute. This satisfies the security and reliability requirement by preventing an agent from autonomously performing irreversible transactions, letting a human verify intent and parameters first.

Why this answer

Option A is correct because human-in-the-loop confirmation is a key safety pattern in agentic systems: before the agent invokes high-impact or destructive transactional tool calls (e.g., deleting records, issuing payments, modifying production resources), a human approval gate prevents irreversible or costly actions caused by model hallucination or prompt injection. Option B is correct because model-generated parameters are untrusted input; validating and sanitizing them (type checks, allowlists, schema validation, escaping) before passing them to downstream enterprise tool APIs prevents injection attacks, malformed requests, and unintended data exposure. Option C is wrong because disabling logging and telemetry removes the observability needed to detect failures, audit tool calls, and debug agent loops, and it does not meaningfully improve reliability or security.

Option D is wrong because granting unrestricted administrative permissions violates least privilege and dramatically increases blast radius if the agent is compromised or misbehaves. Option E is wrong because relying solely on the model's internal memory provides no durable, auditable multi-session state, leading to context loss, inconsistency, and inability to recover or trace conversations.

Exam trap

AI-103 often tests the misconception that giving an agent broad permissions and disabling logging improves autonomy, when in fact least privilege, observability, and human approval are the correct reliability and security practices.

Practice this question →

102

MCQhard

You notice your Azure AI agent is producing offensive content. You need to configure a guardrail that intercepts the model output before it is sent to the user. Which service should you integrate?

A.Azure AI Search Filters

B.Prompt Template Validation

C.Azure Monitor

D.Azure AI Content Safety

AnswerD

Azure AI Content Safety provides output moderation that evaluates model-generated text and blocks harmful categories before delivery to the user. Integrating it as a post-processing guardrail on the agent's response pipeline directly intercepts offensive output, satisfying the requirement to filter content after generation.

Why this answer

Azure AI Content Safety is the dedicated Azure service that provides guardrails for harmful content, including hate, violence, sexual, and self-harm categories, and can be applied to both prompts and completions. Integrating it on the output path lets you intercept and block offensive model responses before they reach the user. This is the purpose-built service for content moderation in Azure AI workloads.

Exam trap

AI-103 often tests the confusion between observability tools (Azure Monitor) and enforcement tools (Azure AI Content Safety) — monitoring can detect offensive content but only Content Safety can block it in the response path.

How to eliminate wrong answers

Option A is wrong because Azure AI Search Filters control which documents are retrieved from an index based on metadata or semantic criteria; they do not evaluate or block offensive model output. Option B is wrong because Prompt Template Validation checks the structure and safety of prompt templates at design time, not the runtime model output sent to users. Option C is wrong because Azure Monitor is an observability platform for metrics, logs, and alerts; it can detect that offensive content occurred but cannot intercept and block it in the request path.

Practice this question →

103

MCQmedium

You are using Azure AI Foundry to deploy an agent. You want to ensure that the agent only uses approved data sources. Which feature should you configure?

A.Prompt engineering for 'Do not use external info'.

B.Grounding data configuration in the Agent settings.

C.Model temperature control.

D.Content Safety policy filters.

AnswerB

Grounding data configuration binds the agent to specified indexes and connections, restricting retrieval to approved sources. It directly satisfies the constraint that the agent must only use approved data sources, preventing unvetted content from entering the prompt context.

Why this answer

Grounding data configuration in the Agent settings is where you specify the approved data sources (e.g., Azure AI Search indexes, uploaded files, or connected knowledge bases) that the agent can use. By configuring only approved sources, you restrict the agent's knowledge to vetted content, ensuring it does not pull from unapproved external information. This is the correct control for data source governance in Azure AI Foundry agents.

Exam trap

AI-103 often tests the difference between soft controls (prompt instructions) and hard controls (configuration); the trap is choosing a prompt-based instruction when the requirement is to technically restrict data sources, which only grounding configuration can enforce.

How to eliminate wrong answers

Option A is wrong because prompt engineering instructions like 'Do not use external info' are not enforceable; the model may still use parametric knowledge or ignore instructions, and it does not technically restrict data sources. Option C is wrong because model temperature controls randomness/creativity, not which data sources are accessed. Option D is wrong because Content Safety policy filters moderate harmful content categories and do not govern the provenance or approval of grounding data.

Practice this question →

104

Multi-Selectmedium

Which TWO of the following are valid methods to improve the quality of retrieved data in a RAG system?

Select 2 answers

A.Reducing the number of vector dimensions

B.Implementing a hybrid search strategy

C.Optimizing document chunking strategies

D.Changing the chat history session length

E.Increasing the number of tokens in the prompt

AnswersB, C

Hybrid search combines keyword and vector retrieval, so exact terms and semantic similarity both contribute to ranking. This satisfies the stem's retrieval-quality constraint by surfacing relevant chunks that pure vector search misses when precise terminology matters.

Why this answer

Option B is correct because a hybrid search strategy combines dense vector similarity with sparse keyword retrieval (e.g., BM25), which improves recall and precision by matching both semantic meaning and exact terms, directly enhancing the quality of retrieved documents in a RAG pipeline. Option C is correct because optimizing document chunking strategies—such as choosing appropriate chunk sizes and overlaps or semantic chunking—ensures that retrieved passages are coherent and contextually complete, which raises the relevance and usefulness of the context passed to the LLM. Option A is not correct because reducing vector dimensions typically trades off retrieval accuracy for storage and speed, degrading rather than improving retrieval quality.

Option D is not correct because chat history session length affects conversational context, not the retrieval mechanism or the quality of retrieved documents. Option E is not correct because increasing prompt tokens only changes how much context is fed to the model and does not improve the retrieval step itself.

Exam trap

AI-103 often tests the confusion between retrieval-side improvements (hybrid search, chunking) and generation-side or session-side settings (prompt length, chat history), which do not change retrieved data quality.

Practice this question →

105

MCQhard

You are building an agent in Azure AI Foundry using a prompt flow. You need to ensure that the agent only accesses specific internal documents and avoids hallucinating outside the provided context. Which grounding technique should you implement?

A.Implement grounding with data using Azure AI Search

B.Use a system message to forbid outside information

C.Enable prompt caching

D.Increase the temperature parameter to 1.0

AnswerA

Azure AI Search indexes the specific internal documents and returns retrieved chunks as grounding context, constraining the model's answer to that content. This satisfies the stem's constraint of restricting access to specific documents and preventing hallucination beyond the provided context, unlike relying on the model's parametric knowledge alone.

Why this answer

Grounding with data using Azure AI Search connects the agent to a specific indexed document set, so responses are generated only from retrieved content. This directly prevents hallucination by constraining the model's context to the internal documents. System messages alone cannot guarantee the model will ignore its pretrained knowledge.

Exam trap

AI-103 often tests the misconception that a system message or prompt instruction can reliably prevent hallucination, when in fact only grounding with a trusted data source enforces factual boundaries.

How to eliminate wrong answers

Option B is wrong because a system message is a soft instruction that the model may ignore, especially with ambiguous prompts; it does not enforce data boundaries. Option C is wrong because prompt caching improves latency and cost, not grounding or factual accuracy. Option D is wrong because increasing temperature to 1.0 makes output more random and creative, worsening hallucination.

Practice this question →

106

MCQeasy

A developer on your team is configuring an Azure AI Foundry agent that must answer questions about a product catalog stored in Azure Cosmos DB for NoSQL. The agent must retrieve the current price and stock for a given product SKU at query time. Which tool should the agent use?

A.The code interpreter tool to run a Python script that connects to Cosmos DB and computes the price.

B.A function tool that queries Cosmos DB for the SKU and returns the current price and stock as JSON.

C.The file search tool with a CSV export of the catalog uploaded to the agent's vector store.

D.The Azure AI Search tool pointed at an index populated nightly from Cosmos DB.

AnswerB

A function tool lets the agent execute deterministic code that reads the authoritative Cosmos DB record at request time, returning current price and stock. Structured lookups by key are exactly the case function calling is designed for, and the returned JSON can be inserted into the model's context for a grounded answer.

Why this answer

A function tool is the correct choice because it allows the agent to execute authenticated code that queries Cosmos DB for the exact SKU and returns live price and stock values. Function calling is intended for deterministic, structured lookups where a vector index or static file would return stale data.

Exam trap

The trap here is reaching for a retrieval tool by habit when the requirement is a live, exact-key lookup that only a function tool can satisfy.

Practice this question →

107

MCQhard

You are building an agentic workflow in Azure AI Foundry. You need the agent to perform a multi-step task: search a database, summarize results, and then send an email. Which component is best suited to manage this orchestration?

A.Azure AI Agent Service.

B.Azure OpenAI fine-tuning service.

C.Azure AI Search indexer.

D.Azure AI Content Safety API.

AnswerA

Azure AI Agent Service provides built-in orchestration for multi-step tool use, chaining database search, summarisation and email sending through its thread and tool-calling runtime. It satisfies the requirement to manage sequential task orchestration without custom glue code.

Why this answer

Azure AI Agent Service is purpose-built to orchestrate multi-step agentic workflows, including tool/function calling, planning, and chaining actions like database queries, summarization, and email dispatch. It manages conversation state, tool invocation, and step sequencing natively, which is exactly what this scenario requires.

Exam trap

AI-103 often tests whether candidates confuse model customization (fine-tuning) or data retrieval (AI Search) with orchestration, so they pick a component that handles only one sub-task instead of the agent runtime that manages the whole multi-step flow.

How to eliminate wrong answers

Option B is wrong because fine-tuning only customizes a model's behavior on training data; it does not orchestrate tools or multi-step actions. Option C is wrong because an Azure AI Search indexer ingests and enriches data into a search index; it cannot plan or execute workflows. Option D is wrong because Content Safety only classifies and filters harmful content, providing no orchestration capability.

Practice this question →

108

Multi-Selecthard

You are optimizing an enterprise RAG application in Azure AI Foundry for high accuracy and minimal latency. Which THREE advanced retrieval techniques should you consider implementing? (Choose THREE)

Select 3 answers

A.Semantic ranking to re-rank top search results using deep learning models

B.Using random sentence selection without indexing

C.Hybrid search combining full-text BM25 and vector embeddings

D.Disabling vector search entirely to rely solely on random string matching

E.Query expansion and re-writing to enrich user prompts with synonyms and related terms

AnswersA, C, E

Semantic ranking applies deep-learning re-ranking to the top results returned by the initial retrieval pass, lifting relevance precision beyond keyword or vector similarity alone. This directly serves the stem's high-accuracy constraint while capping latency, since re-ranking runs only over a small candidate set rather than the full index.

Why this answer

Option A (Semantic ranking) is correct because Azure AI Search's semantic ranker applies deep-learning language models to re-rank the top BM25/vector results, promoting the most contextually relevant passages and directly improving RAG answer accuracy. Option C (Hybrid search combining full-text BM25 and vector embeddings) is correct because fusing keyword and dense-vector retrieval via Reciprocal Rank Fusion captures both exact term matches and semantic similarity, which raises recall and precision over either method alone. Option E (Query expansion and re-writing) is correct because enriching the user prompt with synonyms and related terms broadens the candidate set and aligns the query with the indexed content, improving retrieval quality for ambiguous or short queries.

Option B does not belong because random sentence selection without indexing provides no relevance signal or deterministic retrieval, guaranteeing poor accuracy. Option D does not belong because disabling vector search and relying on random string matching discards semantic retrieval entirely, which destroys both accuracy and the ability to handle natural-language queries.

Exam trap

AI-103 often tests whether candidates confuse retrieval-quality techniques (hybrid, semantic, query expansion) with unrelated or destructive options like disabling vector search or random selection, which sound plausible but break the RAG pipeline.

Practice this question →

109

MCQmedium

You need to ensure that your agent is compliant with regional data residency requirements. Where should you check this?

A.In the Prompt Flow runtime.

B.In the Content Safety policy.

C.In the model configuration settings.

D.In the Azure AI Foundry resource's region settings.

AnswerD

Regional data residency is enforced by the Azure AI Foundry resource's own region, since data is stored and processed there. Checking that resource's region settings confirms whether the deployed agent keeps data within the required geography, directly satisfying the compliance constraint in the stem.

Why this answer

Data residency for Azure AI Foundry is governed by the region of the Azure AI Foundry resource (and its dependent resources such as the model deployment and storage). To verify compliance with regional data residency requirements, you check the resource's region settings, because that determines where data is stored and processed. Content safety policies, prompt flow runtime, and model configuration do not control geographic placement.

Exam trap

AI-103 often tests the confusion between configuration settings that affect behavior (content safety, model parameters, prompt flow) and the resource-level region setting that actually governs data residency.

How to eliminate wrong answers

Option A is wrong because the Prompt Flow runtime is an execution environment for flows and does not determine where data is stored or processed for residency purposes. Option B is wrong because Content Safety policies define filtering thresholds and categories, not geographic data placement. Option C is wrong because model configuration settings control parameters like temperature, max tokens, and model version, not the region in which the resource and its data reside.

Practice this question →

110

MCQeasy

When sharing a Prompt Flow with a teammate, which action allows them to run the flow without having to recreate the connections?

A.Delete the connection and recreate it

B.Grant permissions to the shared Connection resource

C.Hardcode credentials into the flow

D.Export the flow as a text file

AnswerB

Prompt Flow connections hold credentials and endpoint configuration, so a teammate needs permission on the shared Connection resource itself. Granting that access lets them run the flow using the existing connection rather than recreating it with their own credentials.

Why this answer

When sharing a Prompt Flow with a teammate, the flow references a Connection resource by name. To let the teammate run the flow without recreating the connection, you grant them permissions (e.g., Cognitive Services User or equivalent RBAC role) on the shared Connection resource in Azure AI Foundry. This way the flow resolves the same connection at runtime for both users, and credentials remain centralized and secure.

Exam trap

The trap is thinking that sharing the flow file itself is sufficient — candidates may pick 'export the flow as a text file' because it sounds like sharing, but the flow only works if the recipient also has RBAC permissions on the referenced Connection resource.

How to eliminate wrong answers

Option A is wrong because deleting and recreating the connection would break the flow's reference and force reconfiguration — it is the opposite of what you want when sharing. Option C is wrong because hardcoding credentials into the flow embeds secrets in the flow artifact, which is insecure and defeats the purpose of using connections; it also means the teammate uses your credentials directly, which is an audit and rotation nightmare. Option D is wrong because exporting the flow as a text file does not transfer connection permissions — the teammate would still lack access to the referenced connection and would have to recreate it, which is exactly what the question says to avoid.

Practice this question →

111

MCQmedium

You are using Prompt Flow to iterate on an agent. What is the benefit of using 'Environment Variables' in your flow?

A.To manage configuration settings like API keys and endpoints across environments.

B.To reduce the model response time.

C.To store large data files.

D.To increase the prompt length.

AnswerA

Environment variables hold configuration such as API keys and endpoints outside the flow definition, so the same flow can be promoted between development, test and production without editing nodes. This satisfies the stem's need to manage settings across environments.

Why this answer

Environment variables in Prompt Flow let you externalize configuration such as API keys, endpoints, and deployment names so the same flow can run against different environments (dev, test, prod) without code changes. This is the standard twelve-factor app pattern and is the primary benefit of using environment variables in a flow.

Exam trap

The trap is conflating environment variables with performance or data-storage features — candidates may pick 'reduce response time' or 'store large data files' because they associate configuration with optimization, but environment variables are strictly for externalized configuration and secrets management.

How to eliminate wrong answers

Option B is wrong because environment variables do not affect model inference latency — response time is determined by model size, prompt length, and service load, not by how configuration is stored. Option C is wrong because environment variables are meant for small configuration values, not large data files; storing large files in environment variables would hit size limits and is an anti-pattern. Option D is wrong because environment variables have no effect on prompt length — prompt length is determined by the text you send to the model, not by configuration storage.

Practice this question →

112

MCQhard

You are experiencing high latency in your RAG agent. You confirm the model response time is fine, but the retrieval step is slow. What should you investigate?

A.The system prompt length.

B.The content safety threshold.

C.The model temperature.

D.The index retrieval configuration and semantic ranker parameters.

AnswerD

Since generation latency is acceptable, the bottleneck lies in retrieval. Index configuration, chunking, vector search settings and semantic ranker parameters directly govern how long candidate documents take to fetch and rerank, so these are the components to profile.

Why this answer

Since the LLM response time is confirmed fine, the bottleneck is in the retrieval pipeline. Index configuration (chunk size, vector dimensions, HNSW/IVF parameters) and semantic ranker settings (which add an L2 reranking pass) directly determine retrieval latency. Tuning these — e.g., reducing semantic ranker usage or adjusting efSearch/kNN — is the correct investigation path.

Exam trap

The trap here is assuming latency is always a model/prompt issue; AI-103 tests whether you can isolate the retrieval stage and correctly attribute slowness to index and semantic ranker configuration rather than generation parameters.

How to eliminate wrong answers

Option A is wrong because system prompt length affects token processing and generation time on the model side, which the question states is already fine. Option B is wrong because content safety thresholds affect whether content is blocked, not retrieval latency. Option C is wrong because temperature only influences sampling randomness during generation, not retrieval speed.

Practice this question →

113

MCQhard

An agent is designed to summarize meeting transcripts but keeps including internal meeting notes in the final summary. What is the most effective way to address this?

A.Update the system prompt to clarify which sections of the transcript to include.

B.Lower the temperature.

C.Switch to a different model.

D.Add a 'stop_sequence' to the API call.

AnswerA

System prompts define the agent's scope and boundaries, so explicitly restricting the summary to transcript sections excludes internal notes. This is a prompt-engineering fix applied before retrieval or post-processing, directly addressing the unwanted content at generation time.

Why this answer

The system prompt is the primary control surface for defining an agent's scope, tone, and what content it should include or exclude. When an agent incorrectly includes internal meeting notes, the root cause is usually ambiguous instructions about which transcript sections are in-scope, so clarifying the inclusion/exclusion rules in the system prompt directly fixes the behavior. This is a prompt engineering fix, not a model parameter fix, because the issue is about instruction-following scope rather than randomness or creativity.

Exam trap

AI-103 often tests the misconception that model parameters like temperature or stop sequences can fix content-scope problems, when in fact scope and inclusion rules belong in the system prompt.

How to eliminate wrong answers

Option B is wrong because lowering temperature only reduces randomness in token sampling and does not change what content the model considers in-scope; the agent would still include internal notes, just more deterministically. Option C is wrong because switching models does not address the underlying ambiguity in the instructions and may introduce new behavioral differences without solving the scope problem. Option D is wrong because a stop_sequence only halts generation when a specific string is emitted; it cannot selectively filter which transcript sections are summarized and would truncate output rather than correct inclusion logic.

Practice this question →

114

MCQhard

You are implementing a RAG pipeline where documents are chunked before embedding generation. You notice that semantic sentences are frequently split across chunk boundaries, resulting in degraded retrieval quality. Which chunking strategy should you implement to resolve this?

A.Sliding window chunking with token overlap

B.Fixed-character chunking with zero overlap

C.Paragraph-only splitting with maximum size limits of 10,000 tokens

D.Random token slicing

AnswerA

Sliding window chunking with token overlap carries trailing tokens from one chunk into the next, so sentences spanning a boundary still appear intact in at least one chunk. This directly resolves the semantic splitting that degraded retrieval quality.

Why this answer

Sliding window chunking with token overlap is correct because it preserves semantic continuity by carrying a portion of the previous chunk's tokens into the next chunk. This overlap ensures that sentences or ideas spanning a boundary appear intact in at least one chunk, so the embedding captures the full semantic unit. It directly addresses the root cause of degraded retrieval: fragmented context at chunk edges.

Exam trap

AI-103 often tests the misconception that smaller, non-overlapping chunks improve precision, when in fact zero overlap causes boundary fragmentation that silently degrades recall.

How to eliminate wrong answers

Option B is wrong because fixed-character chunking with zero overlap guarantees that any sentence crossing a boundary is permanently split with no recovery, worsening the fragmentation problem. Option C is wrong because paragraph-only splitting with a 10,000-token maximum produces enormous chunks that exceed typical embedding model context windows (e.g., 8,191 tokens for text-embedding-ada-002) and dilute semantic focus, and paragraphs alone do not prevent mid-sentence splits when a paragraph exceeds the limit. Option D is wrong because random token slicing destroys all linguistic structure, producing incoherent chunks that yield meaningless embeddings and unusable retrieval.

Practice this question →

115

MCQhard

You are implementing Retrieval-Augmented Generation (RAG) using Azure AI Search as the retriever and Azure OpenAI as the generator. Users report that the generated responses frequently miss critical context located in the middle of long retrieved documents. Which grounding optimization technique should you apply?

A.Increase the temperature parameter of the Azure OpenAI model to 1.2 to encourage creative synthesis of the middle content.

B.Switch the Azure AI Search retriever from hybrid search to pure keyword BM25 search.

C.Implement semantic ranking and reorder retrieved documents so the highest-scored chunks appear at the very beginning and end of the prompt context.

D.Reduce the chunk size to 64 tokens to force the retriever to return hundreds of tiny fragments.

AnswerC

Positional bias causes models to attend most strongly to the start and end of context, neglecting middle chunks. Semantic ranking selects the most relevant chunks, and deliberately placing the highest-scored ones at the prompt's beginning and end counteracts the lost-in-the-middle effect.

Why this answer

LLMs exhibit a 'lost in the middle' bias where content at the beginning and end of the context window is attended to more strongly than content in the middle. Applying semantic ranking to surface the most relevant chunks and then reordering them so the highest-scored chunks sit at the start and end of the prompt mitigates this positional bias and improves grounding.

Exam trap

AI-103 often tests the misconception that increasing temperature or switching search modes fixes grounding issues, when the real fix targets the LLM's positional attention bias through semantic ranking and chunk reordering.

How to eliminate wrong answers

Option A is wrong because raising temperature to 1.2 increases randomness and hallucination rather than improving retrieval of middle content, and temperature does not affect attention to context position. Option B is wrong because switching from hybrid search to pure BM25 keyword search discards vector similarity, typically reducing recall and relevance rather than fixing positional attention bias. Option D is wrong because shrinking chunks to 64 tokens fragments context, destroys semantic coherence, and floods the prompt with hundreds of low-value fragments, worsening grounding.

Practice this question →

116

MCQeasy

You are evaluating a generative AI application in Azure AI Foundry using automated metrics. You need to measure how well the generated answers are supported by the retrieved source documents. Which evaluation metric should you use?

A.Word Error Rate (WER)

B.Groundedness

C.BLEU score

D.Perplexity

AnswerB

Groundedness measures whether generated answers are supported by the retrieved source documents, directly matching the stem's requirement. It detects hallucinated content unsupported by context, unlike relevance, fluency or coherence, which assess other quality dimensions of the generative response.

Why this answer

Groundedness measures how well a model's generated response is supported by the retrieved source documents, which is exactly the requirement in a RAG-style generative AI application. Azure AI Foundry's evaluation SDK provides a groundedness metric that uses an LLM judge to check whether claims in the answer are entailed by the provided context.

Exam trap

AI-103 often tests the confusion between generation-quality metrics (BLEU, perplexity, WER) and RAG-specific metrics (groundedness, relevance), so candidates who pick a familiar NLP metric miss the grounding requirement.

How to eliminate wrong answers

Option A is wrong because Word Error Rate measures transcription accuracy in speech-to-text scenarios, not answer grounding. Option C is wrong because BLEU compares n-gram overlap between generated and reference text — it measures surface similarity, not factual support by retrieved documents. Option D is wrong because perplexity measures how well a language model predicts a token sequence and is a training-time metric, not a grounding metric.

Practice this question →

117

Multi-Selecteasy

Which TWO components are essential for creating an effective system prompt?

Select 2 answers

A.A clear definition of the agent's persona and objective.

B.A list of all users authorized to use the agent.

C.The full training dataset of the base model.

D.Constraints and instructions on how to handle edge cases or disallowed topics.

E.A list of all hardware components in the data center.

AnswersA, D

Defining the agent's persona and objective anchors every subsequent instruction, giving the model a stable role and success criteria to reason against. Without this, responses drift and tone becomes inconsistent, so it satisfies the stem's requirement for an essential system-prompt component.

Why this answer

Option A is correct because an effective system prompt must establish the agent's persona and objective, giving the model a clear role, tone, and goal that shape all subsequent responses. Option D is correct because system prompts need explicit constraints and instructions for edge cases or disallowed topics, which set behavioral boundaries and safety guardrails for the agent. Options B, C, and E are not essential: authorized-user lists are typically enforced by authentication and access-control systems rather than the prompt, the base model's full training dataset is not something the prompt author supplies, and data center hardware details are irrelevant to prompt design.

Exam trap

AI-103 often tests whether candidates understand that system prompts define behavior and boundaries, not access control or infrastructure — candidates may pick 'list of authorized users' because it sounds like a security requirement, but authorization is enforced outside the model.

Practice this question →

118

MCQmedium

You are implementing a tool call in a Prompt Flow. The tool needs to interact with an external REST API. What is the recommended way to manage the API credentials securely?

A.Pass the key as a parameter in the input prompt

B.Hardcode the API key in the Prompt Flow code

C.Use an environment variable in the flow definition

D.Use an Azure AI Foundry Connection of type Custom

AnswerD

A Custom Connection in Azure AI Foundry stores the API key or token as a managed secret, so Prompt Flow tools reference it by name rather than embedding credentials in code. This satisfies the requirement to manage the REST API credentials securely.

Why this answer

Azure AI Foundry Connections of type Custom are the recommended way to store and manage credentials for external services such as REST APIs. A Custom connection securely stores the API key or token in the Foundry workspace, and the Prompt Flow tool references the connection by name, so credentials are never exposed in code or prompts. This integrates with Azure RBAC and Key Vault for secure secret storage.

Exam trap

The trap is assuming that environment variables are a secure way to store secrets — candidates often pick 'use an environment variable' because it sounds like a best practice, but in Azure AI Foundry the recommended secure mechanism is a Connection backed by Key Vault, not a plain environment variable.

How to eliminate wrong answers

Option A is wrong because passing the key as a parameter in the input prompt exposes the credential in the prompt text, logs, and conversation history — a serious security anti-pattern. Option B is wrong because hardcoding the API key in the Prompt Flow code embeds the secret in source control and flow artifacts, making rotation and auditing difficult and risking leakage. Option C is wrong because while environment variables can hold configuration, they are not a secure secrets store — they can leak through logs, process listings, and flow exports, and they lack the RBAC and Key Vault integration that Foundry Connections provide.

Practice this question →

119

MCQhard

You need to optimize the retrieval performance of your RAG agent. You find that the search engine returns too many irrelevant documents. What should you adjust?

A.Configure Hybrid Search settings in the search index.

B.Increase the model temperature.

C.Change the model to a newer version.

D.Reduce the system prompt length.

AnswerA

Hybrid search combines keyword and vector queries, letting you tune weighting between semantic similarity and exact term matching. Raising the keyword component or adjusting the fusion ranking filters out documents that match only loosely on embeddings, directly reducing the irrelevant results the stem describes.

Why this answer

Hybrid Search in Azure AI Search combines keyword (BM25) and vector similarity with Reciprocal Rank Fusion (RRF), and lets you tune parameters like k-nearest neighbors count, semantic ranker, and weighting to improve precision. When too many irrelevant documents are returned, adjusting hybrid search settings — such as enabling semantic reranking or reducing top-k — directly addresses retrieval relevance. The other options affect generation, not retrieval.

Exam trap

AI-103 often tests whether candidates can separate retrieval tuning (index, hybrid search, semantic ranker, top-k) from generation tuning (temperature, model version, prompt length) — candidates frequently pick temperature or model upgrades when the problem is retrieval relevance.

How to eliminate wrong answers

Option B is wrong because increasing model temperature makes the LLM's output more random and creative; it does not change which documents the retriever returns and will likely worsen answer quality. Option C is wrong because upgrading the model version changes generation quality, not retrieval precision — irrelevant documents will still be retrieved and passed to the model. Option D is wrong because shortening the system prompt affects instruction-following and token cost, not the relevance of retrieved documents.

Practice this question →

120

MCQmedium

You are implementing a RAG solution where documents contain complex hierarchical headings. To ensure search chunks retain sufficient context about which section they belong to, what chunking strategy should you adopt?

A.Fixed-size character chunking with zero overlap

B.Random token sampling without structural awareness

C.Single-chunk whole document ingestion

D.Hierarchical (parent-child) chunking retaining section headers

AnswerD

Hierarchical parent-child chunking indexes small child chunks for precise embedding matches while linking each to a larger parent containing its section headers and surrounding hierarchy. Retrieved children are expanded to parents, so chunks retain the heading context the stem requires for complex hierarchical documents.

Why this answer

Hierarchical (parent-child) chunking retains section headers and structural context, so each child chunk knows which parent section it belongs to. This preserves the document's hierarchy, ensuring that retrieved chunks carry enough context for the LLM to answer accurately. It is the recommended strategy for complex hierarchical documents in RAG.

Exam trap

The trap is defaulting to fixed-size chunking because it is simple — the exam tests whether you recognize that hierarchical documents require structure-aware chunking to preserve context.

How to eliminate wrong answers

Option A is wrong because fixed-size chunking with zero overlap ignores document structure and can split mid-section, losing header context. Option B is wrong because random token sampling destroys semantic and structural coherence. Option C is wrong because ingesting the whole document as a single chunk exceeds context limits and reduces retrieval precision.

Practice this question →

121

MCQmedium

You are integrating Azure AI Search with Azure OpenAI for grounded chat generation. Users report that the generated answers are accurate, but the citations returned to the user point to raw internal file paths rather than user-friendly web URLs. How should you resolve this?

A.Enable Azure AI Content Safety citation filtering

B.Decrease the search result top_k parameter to 1

C.Store public URL equivalents in index metadata fields and configure citation mapping in your orchestration layer

D.Modify the Azure OpenAI system prompt to guess web URLs based on file names

AnswerC

Storing public URL equivalents in index metadata lets retrieval return the user-facing address alongside each chunk, while citation mapping in the orchestration layer substitutes that metadata into the response instead of the raw file path. This satisfies the stem's constraint: accurate answers with citations pointing to friendly web URLs.

Why this answer

Citations in grounded chat are generated from metadata fields in the Azure AI Search index; to return user-friendly URLs, you must store the public URL in a retrievable metadata field (e.g., 'url' or 'source_url') and configure your orchestration layer to map that field into the citation output. Azure OpenAI's 'on your data' feature and custom RAG pipelines both rely on index metadata for citation rendering. This is a data-modeling and orchestration fix, not a model or safety fix.

Exam trap

AI-103 often tests whether candidates understand that citations come from index metadata, not from the LLM, tricking them into trying to fix citations via prompt engineering or content safety settings.

How to eliminate wrong answers

Option A is wrong because Azure AI Content Safety filters harmful content; it has no role in citation URL formatting or metadata mapping. Option B is wrong because reducing top_k to 1 only limits the number of retrieved documents — it does not change what URL is embedded in the citation, and it degrades answer quality. Option D is wrong because instructing the model to 'guess' URLs is unreliable and will produce hallucinated links, violating grounding principles and potentially exposing incorrect references.

Practice this question →

122

MCQmedium

You are building a RAG application where documents are updated frequently. You need to ensure that the Azure AI Search index reflects document deletions and updates in near real-time without performing full re-indexing. How should you design the ingestion pipeline?

A.Increase the Azure OpenAI model deployment concurrency quota

B.Enable semantic caching on the OpenAI endpoint

C.Configure Azure AI Search indexers with change tracking and scheduled incremental synchronization

D.Delete the entire search service and recreate the index daily using a batch script

AnswerC

Indexers with change tracking detect additions, updates and deletions in the data source, then apply only those deltas on a schedule. This keeps the index synchronised in near real-time without rebuilding it, satisfying the no-full-re-indexing constraint.

Why this answer

Azure AI Search indexers support change tracking via the data source's native mechanisms (e.g., SQL rowversion, Cosmos DB change feed, or blob soft-delete policies) and run on a schedule to detect and apply only changed or deleted documents. This incremental synchronization keeps the index current in near real-time without full re-indexing. It is the designed pattern for frequently updated content.

Exam trap

AI-103 often tests whether candidates confuse model-side tuning (quota, caching) with data-plane synchronization, so choose the option that explicitly mentions indexers with change tracking.

How to eliminate wrong answers

Option A is wrong because increasing Azure OpenAI deployment concurrency quota affects request throughput to the model, not index freshness or document synchronization. Option B is wrong because semantic caching stores prior model responses to reduce latency and cost; it does not update the search index when source documents change. Option D is wrong because deleting and recreating the search service daily is destructive, causes downtime, loses index configuration, and is not near-real-time — it is the opposite of incremental synchronization.

Practice this question →

123

Multi-Selectmedium

Which TWO factors directly influence the embedding quality and retrieval relevance in an Azure AI Search vector retrieval pipeline? (Choose two.)

Select 2 answers

A.The background color of the source documents in blob storage.

B.The choice of embedding model (e.g., text-embedding-3-large vs text-embedding-3-small) and its dimensionality.

C.The font family used in the original PDF documents.

D.The client browser version used by the end user.

E.The chunking strategy and chunk size used to segment source documents.

AnswersB, E

The embedding model determines the vector space's semantic resolution and its dimensionality sets how much meaning each vector can encode. A richer, higher-dimensional model such as text-embedding-3-large captures finer distinctions, directly improving retrieval relevance in the Azure AI Search pipeline.

Why this answer

Option B is correct because the embedding model determines the semantic quality of the vectors stored in the Azure AI Search index: text-embedding-3-large produces higher-fidelity, higher-dimensional vectors (3072 dimensions) than text-embedding-3-small (1536 dimensions), directly affecting how well semantic similarity matches user intent during vector search. Option E is correct because chunking strategy and chunk size control the granularity of the indexed content; chunks that are too large dilute the embedding with unrelated content, while chunks that are too small lose context, so both the segmentation method (e.g., fixed-size, sentence-aware, or document-layout-aware) and the chunk length materially affect retrieval relevance. Options A and C are incorrect because background color and font family are visual formatting attributes that are not captured by text embedding models and have no bearing on vector similarity.

Option D is incorrect because the end user's browser version affects client-side rendering and request handling, not the embedding quality or the relevance scoring performed by Azure AI Search.

Exam trap

AI-103 often tests whether candidates can distinguish content-affecting factors from cosmetic ones — the trap is selecting superficial attributes (font, background color, browser) instead of the model choice and chunking strategy that actually drive embedding quality.

Practice this question →

124

Multi-Selectmedium

You are configuring an agent in Azure AI Agent Service that needs to utilize tools. Which TWO types of tools are natively supported by Azure AI Agent Service? (Choose TWO)

Select 2 answers

A.Azure SQL Database stored procedure compiler

B.Azure Virtual Machine provisioning extension

C.Function calling (Custom tools/APIs)

D.Azure Stream Analytics tumbling window operator

E.Code Interpreter

AnswersC, E

Function calling lets the agent invoke custom tools and APIs you define, extending it beyond built-in capabilities. Azure AI Agent Service natively supports this tool type, satisfying the requirement that the agent utilise external tools through declared function schemas the model can call.

Why this answer

Azure AI Agent Service natively supports Function calling (option C), which lets the agent invoke custom tools and APIs by defining function schemas that the model can call to retrieve data or perform actions. It also natively supports Code Interpreter (option E), a sandboxed Python execution environment used for data analysis, math, and file generation. Options A, B, and D are not native tool types in Azure AI Agent Service: a 'stored procedure compiler,' a 'VM provisioning extension,' and a 'Stream Analytics tumbling window operator' are unrelated Azure capabilities and cannot be attached as agent tools.

Exam trap

AI-103 often tests whether candidates can distinguish native agent tools from unrelated Azure services that merely sound technical, so eliminate options naming database, VM, or stream-processing features.

Practice this question →

125

MCQeasy

You are implementing Retrieval-Augmented Generation (RAG) in Azure AI Foundry using Azure AI Search as the grounding data source. Which indexing feature should you enable to ensure the system can perform semantic ranking alongside traditional keyword search?

A.Fuzzy Search

B.Lucene Standard Analyzer

C.Semantic Search

D.Vector Normalization

AnswerC

Semantic Search adds a reranking layer over results, using Microsoft's language models to rescore matches by meaning while retaining keyword search. Enabling it on the Azure AI Search index satisfies the requirement for semantic ranking alongside traditional keyword search.

Why this answer

Semantic Search in Azure AI Search enables the semantic ranker, which re-ranks an initial BM25 keyword result set using deep-learning models to better capture query intent. It is the feature that layers semantic ranking on top of traditional keyword (and optionally vector) search, improving relevance for natural-language queries.

Exam trap

AI-103 often tests the confusion between lexical analyzers/fuzzy matching and true semantic ranking, causing candidates to pick analyzer or vector-normalization options that do not provide semantic re-ranking.

How to eliminate wrong answers

Option A is wrong because Fuzzy Search handles typo tolerance and approximate matching in the lexical layer, not semantic re-ranking. Option B is wrong because the Lucene Standard Analyzer is a text-analysis component that tokenizes and normalizes text at index time; it does not provide semantic ranking. Option D is wrong because Vector Normalization scales vector magnitudes for similarity computation (e.g., cosine similarity) and is unrelated to semantic ranking of keyword results.

Practice this question →

126

Multi-Selecteasy

As part of responsible AI practices in Azure AI Foundry, which TWO actions should you perform to evaluate and mitigate model fairness and safety risks before deployment? (Choose two)

Select 2 answers

A.Bypass security reviews if the application is intended for internal enterprise employees only.

B.Run automated evaluations in Azure AI Foundry to measure metrics such as groundedness, relevance, and protected material presence.

C.Remove all system prompts to allow the model complete autonomy during evaluation runs.

D.Perform adversarial testing (red teaming) to identify potential prompt injections, jailbreaks, and unintended behaviors.

E.Hardcode responses for all possible user inputs to eliminate model non-determinism entirely.

AnswersB, D

Automated evaluations in Azure AI Foundry score model outputs against metrics including groundedness, relevance, and protected material presence. This satisfies the stem's evaluation requirement by quantifying safety and quality risks systematically, providing repeatable evidence before deployment rather than relying on manual spot checks.

Why this answer

Option B is correct because Azure AI Foundry's automated evaluation flows let you quantify safety and quality metrics—groundedness, relevance, coherence, fluency, and protected-material/hate-and-unfairness scores—so you can objectively assess fairness and safety risks before deployment. Option D is correct because adversarial testing (red teaming) in Azure AI Foundry systematically probes the model with prompt injections, jailbreak attempts, and other malicious inputs to surface unintended behaviors and safety gaps that must be mitigated prior to release. Option A is wrong because internal-only audiences do not exempt an application from responsible AI security and safety reviews; risk assessments apply regardless of user population.

Option C is wrong because removing system prompts strips guardrails and grounding instructions, increasing unsafe or off-topic outputs rather than enabling meaningful evaluation. Option E is wrong because hardcoding responses is not a fairness/safety evaluation technique and would defeat the purpose of testing a generative model's behavior.

Exam trap

AI-103 often tests the misconception that internal-only applications can skip responsible AI reviews, or that removing system prompts improves safety, causing candidates to select those options instead of evaluation and red teaming.

Practice this question →

127

Multi-Selecthard

You are designing a generative AI application in Azure AI Foundry that supports multi-turn conversations with memory. Which THREE components are required to properly maintain conversational state and context? (Choose THREE)

Select 3 answers

A.Thread or session state storage to persist message history across turns

B.Permanently deleting all messages after every single API turn

C.Setting temperature to 0.0 to erase all memory between calls

D.Message history appending logic in the prompt construction payload

E.Context window management strategy (such as summarization or truncation) to prevent token overflow

AnswersA, D, E

Thread or session state storage persists the ordered message history across turns, keyed to a conversation identifier. Without durable state, each turn starts context-free and the model cannot reference earlier exchanges, so this component satisfies the stem's requirement for multi-turn memory and context retention.

Why this answer

Option A is correct because maintaining conversational state requires a thread or session store that persists the message history across turns, allowing the model to reference earlier exchanges in a multi-turn dialogue. Option D is correct because even with stored history, the application must append prior messages into the prompt payload sent to the model so the context is actually available during inference. Option E is correct because as history grows it will exceed the model's context window, so a strategy such as summarization, truncation, or sliding-window management is needed to prevent token overflow and keep requests valid.

Option B is incorrect because deleting all messages after every turn destroys the memory that multi-turn conversations depend on. Option C is incorrect because temperature controls randomness of sampling, not memory, and setting it to 0.0 does not erase or manage conversational state.

Exam trap

AI-103 often tests whether candidates mistake sampling parameters (temperature) or destructive actions (deleting messages) for memory management, so select the three options that describe storage, prompt assembly, and context-window control.

Practice this question →

128

Multi-Selecthard

You are designing a secure RAG retrieval pipeline in Azure AI Search. Which THREE indexing or search configurations are essential when handling confidential documents? (Choose THREE)

Select 3 answers

A.Encryption at rest using Customer-Managed Keys (CMK)

B.Private Endpoint connections to isolate search traffic within a Virtual Network

C.Disabling all authentication to allow open guest queries

D.Document-level security trimming using OData security filters

E.Storing unencrypted search indexes in public Azure blob containers

AnswersA, B, D

Customer-Managed Keys encrypt Azure AI Search indexes at rest using keys you control in Azure Key Vault, rather than Microsoft-managed keys. This satisfies the confidential-documents constraint by ensuring cryptographic isolation and revocable key control over sensitive indexed content.

Why this answer

Option A is correct because Azure AI Search supports encryption at rest with Customer-Managed Keys (CMK) via Azure Key Vault, which lets you control the key lifecycle and revoke access to confidential index data, a requirement for sensitive workloads. Option B is correct because Private Endpoint connections (via Azure Private Link) give the search service a private IP inside your VNet, so indexing and query traffic never traverses the public internet, isolating confidential retrieval traffic. Option D is correct because document-level security trimming with OData filters (e.g., filtering on a groups or ACL field using search.in or eq) ensures each user only retrieves documents they are authorized to see, preventing leakage of confidential content in RAG responses.

Option C is wrong because disabling authentication would expose the index to anonymous guest queries, directly violating confidentiality. Option E is wrong because storing unencrypted indexes in public blob containers removes both encryption and network isolation, which is unacceptable for confidential documents.

Exam trap

AI-103 often tests whether candidates can identify the three pillars of secure RAG indexing — encryption (CMK), network isolation (Private Endpoint), and authorization (security trimming) — while rejecting obviously insecure options like disabling authentication or public unencrypted storage.

Practice this question →

129

MCQeasy

What is the purpose of 'Batch Inference' in Azure AI Foundry?

A.To create a backup of the agent.

B.To test the agent in real-time.

C.To debug individual chat turns.

D.To run multiple prompts against a large dataset for evaluation.

AnswerD

Batch inference submits many prompts against a large dataset in a single managed job rather than one request at a time. This supports systematic evaluation of model outputs across the dataset, matching the stated purpose.

Why this answer

Batch Inference in Azure AI Foundry is designed to process a large dataset of prompts asynchronously against a deployed model, producing outputs for evaluation, scoring, or bulk generation. It is the mechanism used to run evaluation datasets through a model to compute metrics like groundedness, relevance, and coherence at scale. This makes it the correct answer for running multiple prompts against a large dataset for evaluation.

Exam trap

The trap is confusing Batch Inference with interactive testing or debugging features, causing candidates to pick 'test the agent in real-time' when the question emphasizes large datasets and evaluation.

How to eliminate wrong answers

Option A is wrong because Batch Inference does not create backups of agents — agent backup is not a feature of batch inference at all. Option B is wrong because real-time testing of an agent is done through the playground or interactive chat, not batch inference, which is asynchronous and dataset-oriented. Option C is wrong because debugging individual chat turns is a development-time activity performed in the playground or via tracing, not a batch operation over large datasets.

Practice this question →

130

Multi-Selecthard

Which THREE of the following are components of a standard Prompt Flow DAG (Directed Acyclic Graph)?

Select 3 answers

A.Inputs

B.Outputs

C.Model Training Jobs

D.Tools

E.Data Labeling Projects

AnswersA, B, D

Inputs are a core node type in a Prompt Flow DAG, defining the parameters passed into the flow at runtime. They satisfy the stem's requirement for standard DAG components by acting as entry points that feed data to downstream nodes, alongside other elements such as tools, LLM nodes and outputs.

Why this answer

In a standard Prompt Flow DAG, Inputs (A) are the declared entry points that supply values (for example, a question string or a dataset column) to the flow, making them a required component. Outputs (B) are also required because they define the flow's returned values (such as the model's answer or a score) that downstream consumers or evaluations read. Tools (D) are the executable nodes of the DAG — LLM, Python, Prompt, and built-in tools — and the edges connecting them define the directed acyclic execution order.

Model Training Jobs (C) are not part of a Prompt Flow DAG; training is handled by separate Azure Machine Learning job constructs, not flow nodes. Data Labeling Projects (E) are likewise a distinct Azure Machine Learning feature for annotating data and are not components of a Prompt Flow DAG.

Exam trap

AI-103 often tests whether candidates confuse Prompt Flow DAG components with adjacent Azure ML features like training jobs and labeling projects, which sound pipeline-related but are not part of the flow graph.

Practice this question →

131

MCQeasy

You are deploying an LLM in Azure AI Foundry and need to monitor for toxicity and jailbreak attempts in real-time. Which feature should you enable?

A.Azure AI Content Safety

B.Azure Policy

C.Microsoft Purview Compliance Manager

D.Azure Monitor Log Analytics

AnswerA

Azure AI Content Safety provides real-time classification of prompts and completions, including toxicity severity scores and jailbreak or prompt-injection detection. Enabling it on the Azure AI Foundry deployment intercepts harmful input and output at inference time, meeting the stem's real-time monitoring requirement.

Why this answer

Azure AI Content Safety is the service designed to detect harmful content, including toxicity and jailbreak attempts, in real time for LLM applications. It provides classifiers for hate, violence, sexual, and self-harm content, plus Prompt Shields for jailbreak and indirect prompt injection detection. Enabling it allows pre- and post-processing moderation of prompts and completions.

Exam trap

AI-103 often tests the distinction between AI-specific safety services and general Azure security/governance tools; candidates may pick Azure Monitor or Purview because they sound like monitoring/compliance solutions, missing that Content Safety is the only service that performs real-time toxicity and jailbreak detection.

How to eliminate wrong answers

Option B is wrong because Azure Policy is a governance service for enforcing organizational rules on Azure resources (e.g., allowed regions, SKUs), not for analyzing content or jailbreak attempts. Option C is wrong because Microsoft Purview Compliance Manager assesses compliance posture against regulations and standards; it does not perform real-time content moderation. Option D is wrong because Azure Monitor Log Analytics collects and queries telemetry and logs; it can store Content Safety logs but does not itself detect toxicity or jailbreaks.

Practice this question →

132

MCQhard

You are orchestrating a multi-agent system in Microsoft Foundry where Agent A generates code and Agent B reviews it. Agent B frequently gets stuck in a loop trying to optimize minor syntax formatting. How should you design the agentic workflow to prevent this infinite refinement loop?

A.Disable function calling for Agent B so it can only output text responses.

B.Configure a maximum turn counter and state transition condition in the orchestrator workflow to terminate the loop after a set threshold.

C.Increase the model's presence penalty so Agent B is forced to generate novel review comments.

D.Use a smaller model for Agent B to reduce the quality of its reviews.

AnswerB

A maximum turn counter with an explicit state transition condition caps Agent B's refinement cycles, forcing the orchestrator to exit the review loop once the threshold is reached. This bounds iteration without disabling review, preventing endless syntax optimisation.

Why this answer

Configuring a maximum turn counter and a state transition condition in the orchestrator terminates the loop after a defined threshold, preventing infinite refinement. This is the standard pattern for bounded agentic workflows, ensuring the system exits gracefully when convergence is not reached. It directly addresses the runaway loop without degrading agent capability.

Exam trap

AI-103 often tests the misconception that model parameters (presence penalty, model size) can control agentic loops, when the correct answer is orchestration-level controls like max turn counters and state transition conditions.

How to eliminate wrong answers

Option A is wrong because disabling function calling cripples Agent B's ability to perform reviews that require tools, degrading the workflow rather than fixing the loop. Option C is wrong because presence penalty affects token novelty in generation, not the orchestration logic that causes repeated review cycles — it does not terminate loops. Option D is wrong because using a smaller model reduces review quality and still does not guarantee loop termination; it is a degradation, not a control.

Practice this question →

133

MCQmedium

You are evaluating an agentic workflow in Azure AI Foundry that performs multi-step reasoning. The agent occasionally enters an infinite loop, repeatedly calling the same tool with identical arguments. Which architectural pattern or configuration should you apply to prevent this behavior?

A.Increase the vector store chunk overlap size

B.Configure a maximum iteration step limit in the agent orchestration loop

C.Enable Azure API Management caching for the tool endpoint

D.Set the model frequency penalty to 2.0

AnswerB

A maximum iteration step limit caps the orchestration loop, terminating execution once the count is reached. This directly satisfies the stem's constraint of preventing infinite loops from repeated identical tool calls, since the agent cannot exceed the configured ceiling regardless of its reasoning path.

Why this answer

Agentic workflows in Azure AI Foundry (and similar frameworks like Semantic Kernel or AutoGen) require a bounded orchestration loop; configuring a maximum iteration or step limit causes the orchestrator to terminate or escalate when the agent exceeds the threshold, preventing infinite tool-calling loops. This is the standard architectural safeguard for multi-step reasoning agents. It directly addresses the symptom of repeated identical tool calls.

Exam trap

AI-103 often tests whether candidates confuse model-level parameters (temperature, frequency penalty) with orchestration-level controls, tricking them into picking a sampling parameter to fix a control-flow problem.

How to eliminate wrong answers

Option A is wrong because vector store chunk overlap affects retrieval quality and context continuity, not agent loop control — it has no bearing on repeated tool invocations. Option C is wrong because API Management caching would return cached responses for identical requests, which could mask the loop but does not stop the agent from continuing to call the tool and would produce stale results. Option D is wrong because frequency penalty (max 2.0) only discourages token repetition in generated text; it does not prevent the orchestration layer from re-invoking tools with identical arguments.

Practice this question →

134

MCQmedium

You are implementing a multi-turn conversational agent in Azure AI Foundry. As the conversation grows longer, API latency and costs increase significantly. Which strategy should you implement to manage the conversation history effectively?

A.Increase max_tokens to accommodate infinite history growth.

B.Implement a sliding window history buffer combined with periodic summarization of older dialogue turns.

C.Disable the chat history array entirely and treat every turn as a standalone prompt.

D.Truncate the entire conversation history after every single user turn.

AnswerB

A sliding window caps the tokens sent per turn, directly cutting latency and cost, while periodic summarisation preserves older context that would otherwise be discarded. This satisfies the stem's constraint of rising API latency and expense as the conversation lengthens.

Why this answer

For long multi-turn conversations, the standard pattern is a sliding window that keeps only the most recent N turns plus a running summary of older dialogue. This bounds the token count sent to the model, controlling latency and cost, while preserving essential context through summarization. It is the recommended approach in Azure AI Foundry for managing conversation history.

Exam trap

AI-103 often tests whether candidates understand that context windows are finite and that history must be actively managed — the trap is choosing to increase max_tokens or disable history instead of implementing a sliding window with summarization.

How to eliminate wrong answers

Option A is wrong because increasing max_tokens does not solve unbounded history growth — it raises the output ceiling, not the input context, and the model still has a hard context window limit. Option C is wrong because disabling chat history entirely destroys conversational context, making the agent unable to resolve references or maintain coherence. Option D is wrong because truncating after every single turn is effectively the same as having no history and breaks multi-turn reasoning.

Practice this question →

135

Multi-Selecthard

You are designing an enterprise RAG solution using Azure AI Search and Azure OpenAI. You need to ensure data security and compliance across different user permission tiers. Which TWO actions should you implement? (Choose two.)

Select 2 answers

A.Ensure all data transfers between Azure AI Search and Azure OpenAI utilize TLS 1.2 or higher.

B.Configure security filters (document-level access control) in Azure AI Search matching user group memberships.

C.Store unencrypted user authentication tokens directly inside the embedding vector metadata.

D.Grant every user application admin privileges to bypass retrieval latency checks.

E.Disable managed identities and store plaintext connection strings in the application source code.

AnswersA, B

TLS 1.2 or higher encrypts data in transit between Azure AI Search and Azure OpenAI, preventing interception or downgrade attacks. This satisfies the stem's compliance requirement by protecting cross-service traffic, though it does not by itself enforce per-user document permissions.

Why this answer

Option A is correct because Azure AI Search and Azure OpenAI communicate over HTTPS endpoints, and enforcing TLS 1.2 or higher protects data in transit against interception or downgrade attacks, which is a baseline requirement for enterprise security and compliance. Option B is correct because Azure AI Search supports document-level access control via security filters (for example, using the user's group IDs in a filterable field or the built-in ACL/rbacScope fields), ensuring each permission tier only retrieves documents its users are authorized to see, which is essential in a multi-tenant RAG solution. Option C is wrong because storing unencrypted authentication tokens in embedding metadata exposes credentials to anyone querying the index and violates token-handling best practices.

Option D is wrong because granting admin privileges to all users removes least-privilege enforcement and does not address retrieval latency in a legitimate way. Option E is wrong because disabling managed identities and embedding plaintext connection strings in source code leaks secrets and discards Azure's keyless, identity-based authentication model.

Exam trap

AI-103 often tests whether candidates conflate transport security (TLS) with authorization (document-level filters), or mistakenly believe that embedding metadata is a safe place for secrets — both are common compliance misconceptions.

Practice this question →

136

Multi-Selecthard

You are troubleshooting a multi-agent workflow in Azure AI Foundry where an agent fails to invoke an external API tool correctly. Which THREE debugging steps should you perform? (Choose THREE)

Select 3 answers

A.Test network connectivity and authentication credentials between the agent service and the external API endpoint

B.Restart the client web browser session

C.Inspect the model's generated tool call arguments against the expected JSON Schema definition

D.Review the tool definition schema provided to the model for accurate descriptions and parameter types

E.Increase the Azure DNS TTL value for domain resolution

AnswersA, C, D

A tool invocation crossing a network boundary can fail on connectivity or credential rejection before the model's arguments matter. Verifying reachability and authentication between the agent service and the API endpoint isolates infrastructure faults from schema or prompt faults.

Why this answer

Option A is correct because when an agent fails to invoke an external API tool, you must verify that the agent service can actually reach the endpoint and that its authentication credentials (API keys, OAuth tokens, managed identity, etc.) are valid, since connectivity or auth failures are common root causes of tool invocation errors. Option C is correct because inspecting the model's generated tool call arguments against the expected JSON Schema reveals whether the model is producing malformed, missing, or incorrectly typed parameters that the external API would reject. Option D is correct because the tool definition schema given to the model—including accurate descriptions, parameter names, types, and required fields—directly determines whether the model can generate a valid call; vague or incorrect schemas cause the model to hallucinate or omit arguments.

Option B does not belong because restarting the client browser session only affects the local UI and has no bearing on server-side agent-to-API tool invocation logic. Option E does not belong because increasing Azure DNS TTL affects caching duration for domain resolution and would not fix an agent's failure to correctly construct or authenticate an external API tool call.

Exam trap

AI-103 often tests whether candidates can separate client-side symptoms (browser, DNS TTL) from server-side agent/tool integration issues — the trap is picking a superficially 'networky' answer like DNS TTL instead of the schema and auth checks that actually diagnose tool-call failures.

Practice this question →

137

Multi-Selectmedium

When configuring Azure OpenAI Custom Model Evaluation in Azure AI Foundry, which TWO metrics can be computed using LLM-as-a-judge evaluators? (Choose two.)

Select 2 answers

A.CPU utilization percentage

B.DNS propagation delay

C.Disk input/output operations per second (IOPS)

D.Coherence

E.Relevance

AnswersD, E

Coherence suits this scenario because LLM-as-a-judge evaluators assess subjective, generative qualities that deterministic metrics cannot capture. A judge model scores how logically the response flows and connects ideas, satisfying the stem's requirement for judge-computed metrics rather than similarity-based measures such as BLEU or ROUGE.

Why this answer

Options D and E are correct because Azure AI Foundry's LLM-as-a-judge evaluators are designed to assess the quality of generative AI outputs using a language model as the grader, and Coherence (D) and Relevance (E) are two of the standard quality metrics they compute — Coherence measures how logically well-structured and fluent the response is, while Relevance measures how directly the response addresses the user's query or context. These metrics are part of the built-in evaluation metric set (alongside others such as Fluency, Groundedness, and Similarity) that can be run against a model deployment during custom model evaluation. Options A, B, and C are incorrect because CPU utilization percentage, DNS propagation delay, and disk IOPS are infrastructure and networking performance counters, not language-quality judgments, and they cannot be produced by an LLM-as-a-judge evaluator.

Exam trap

AI-103 often tests the confusion between system performance metrics (CPU, DNS, disk) and AI quality metrics (Coherence, Relevance), tricking candidates into selecting infrastructure metrics for model evaluation.

Practice this question →

138

Multi-Selecthard

You are building an autonomous agentic workflow using Microsoft Foundry and Semantic Kernel. You need to ensure the agent operates safely and adheres to human oversight requirements. Which THREE design patterns should you apply? (Choose three.)

Select 3 answers

A.Grant the agent root-level administrative access to all cloud infrastructure services.

B.Implement human-in-the-loop approval gates before the agent executes high-impact tool actions such as database updates or financial transactions.

C.Configure strict idempotency keys for external tool calls to prevent duplicate actions if retried.

D.Implement circuit breakers to halt agent execution if error rates or token consumption spike abnormally.

E.Allow the agent unlimited recursive tool execution without loop detection.

AnswersB, C, D

Human-in-the-loop approval gates directly satisfy the human oversight requirement by pausing execution before high-impact tool actions, such as database updates or financial transactions, so a person authorises the operation rather than the agent acting autonomously.

Why this answer

Option B is correct because human-in-the-loop approval gates are the canonical oversight control for high-impact, irreversible actions such as database updates or financial transactions, ensuring a human authorizes the action before the agent's tool call is dispatched. Option C is correct because idempotency keys make external tool calls safely retryable: if the agent or orchestrator retries after a timeout or transient failure, the downstream service deduplicates the request so a payment or write is not executed twice. Option D is correct because circuit breakers are a resilience pattern that trips when error rates or token consumption exceed thresholds, halting or degrading agent execution to prevent runaway loops, cost blowups, and cascading failures.

Option A is not appropriate because granting root-level administrative access violates least privilege and dramatically expands the blast radius of any agent error or prompt-injection attack. Option E is not appropriate because unlimited recursive tool execution without loop detection invites infinite loops, resource exhaustion, and uncontrolled cost, directly contradicting safe agent design.

Exam trap

AI-103 often tests the misconception that giving an agent broad permissions or unlimited recursion makes it more capable, when in fact safe agentic design requires least privilege, approval gates, idempotency, and circuit breakers.

Practice this question →

139

MCQmedium

Which Azure AI Foundry feature helps identify drift in model performance after deployment?

A.Model Monitoring

B.Data Drift Analysis via Compute

C.Prompt Flow Tracing

D.Model Catalog

AnswerA

Model Monitoring in Azure AI Foundry continuously tracks deployed model performance against baseline metrics, detecting data and prediction drift over time. It satisfies the stem's requirement to identify post-deployment drift by evaluating live inference data and raising alerts when performance degrades, enabling timely retraining or remediation.

Why this answer

Model Monitoring in Azure AI Foundry continuously evaluates deployed models against production data, tracking data drift, prediction drift, and performance metrics like accuracy and latency. It is the built-in feature designed specifically to detect post-deployment degradation. The other options either describe manual or unrelated capabilities that do not provide ongoing drift detection for deployed models.

Exam trap

The trap here is confusing 'drift analysis' as a generic concept with the specific managed Foundry feature — candidates may pick the manually configured compute option because it sounds more technical.

How to eliminate wrong answers

Option B (Data Drift Analysis via Compute) is wrong because it describes a manual, compute-driven analysis pattern rather than the managed Foundry feature that automatically monitors deployed models. Option C (Prompt Flow Tracing) is wrong because tracing captures prompt-level execution telemetry for debugging and evaluation, not statistical drift in model performance. Option D (Model Catalog) is wrong because the catalog is a discovery and deployment repository for models, not a monitoring or drift-detection service.

Practice this question →

140

MCQeasy

You are designing a customer service chatbot using Azure OpenAI. You need to ensure that the model refuses to answer questions outside the scope of your company's products. Where should you define this boundary instruction?

A.In the temperature setting

B.In the user prompt prefix

C.In the max_tokens parameter configuration

D.In the system message

AnswerD

The system message carries persistent instructions that shape model behaviour across every turn, making it the correct place to define scope boundaries and refusal behaviour. User-turn prompts are per-request and cannot reliably enforce a standing restriction.

Why this answer

The system message is correct because it is the designated channel for persistent, high-priority instructions that define the model's persona, scope, and refusal behavior across all turns of a conversation. Placing the boundary instruction there ensures it applies before and throughout the interaction, and it is the standard mechanism for scoping a chatbot to a domain. This is the architecturally correct location for guardrails that must not be overridden by user input.

Exam trap

AI-103 often tests whether candidates confuse generation parameters (temperature, max_tokens) with instruction channels, so the trap is selecting a sampling or length parameter as the place to define behavioral boundaries.

How to eliminate wrong answers

Option A is wrong because temperature controls sampling randomness (0 = deterministic, higher = more creative) and has no semantic content — it cannot express a scope boundary. Option B is wrong because a user prompt prefix is user-controlled and ephemeral; it applies only to that turn, can be overridden or ignored, and is vulnerable to prompt injection. Option C is wrong because max_tokens limits the length of the completion, not its subject matter — it constrains output size, not scope.

Practice this question →

141

MCQhard

You are optimizing a RAG pipeline in Azure AI Foundry. Users complain that answers are missing key numerical details because important tables within PDF documents are being split across chunk boundaries during ingestion. What is the recommended remediation?

A.Use Azure AI Document Intelligence with layout extraction to parse tables and maintain table structure during chunking

B.Increase the embedding model dimensions from 1536 to 3072

C.Set the Azure OpenAI model max_tokens parameter to 4096

D.Apply Azure AI Content Safety image analysis on all PDF pages

AnswerA

Layout extraction preserves table rows and columns as structured cells, so chunking splits on table boundaries rather than mid-table. This directly satisfies the stem's constraint that numerical table details are lost when tables straddle chunk boundaries.

Why this answer

Azure AI Document Intelligence with layout extraction preserves table structure by detecting rows, columns, and cells during parsing, so tables are chunked as coherent units rather than split arbitrarily. This keeps numerical relationships intact and prevents the retrieval step from returning partial tables that omit key figures. It is the recommended remediation for table-splitting problems in RAG ingestion.

Exam trap

AI-103 often tests whether candidates reach for model-side knobs (embedding dimensions, max_tokens) when the actual problem is data-ingestion parsing, so choose the option that fixes table structure at parse time.

How to eliminate wrong answers

Option B is wrong because increasing embedding dimensions from 1536 to 3072 changes vector representation size but does nothing to preserve table structure during chunking — the table is still split before embedding. Option C is wrong because max_tokens controls the model's output length, not how source documents are parsed or chunked. Option D is wrong because Content Safety image analysis screens images for harmful content and has no role in extracting or preserving tabular data from PDFs.

Practice this question →

142

MCQhard

You are automating document ingestion for a RAG pipeline. Which feature allows you to automatically split large documents into smaller chunks during indexing?

A.Prompt Flow Vector Store Lookup

B.Model Fine-tuning

C.Indexers with Skillsets

D.Vector Embeddings API

AnswerC

Indexers with skillsets satisfy the chunking constraint: the Text Split skill within a skillset segments large documents into smaller chunks during indexing, and the indexer applies it automatically as content flows from the data source into the search index. This built-in enrichment pipeline removes the need for custom pre-processing code.

Why this answer

In Azure AI Search, indexers with skillsets are the feature that automates document ingestion and chunking: the indexer pulls source documents, and a Text Split skill in the skillset breaks large documents into smaller chunks before they are embedded and written to the index. This is the standard mechanism for building a RAG pipeline where chunk size affects retrieval quality. The skillset can also enrich content (OCR, entity extraction, embeddings) in the same pipeline.

Exam trap

AI-103 often tests the confusion between retrieval-time components (vector store lookup, embeddings API) and ingestion-time components (indexers with skillsets), so candidates pick the embedding API thinking it handles chunking.

How to eliminate wrong answers

Option A is wrong because Prompt Flow Vector Store Lookup is a retrieval-time node that queries an existing vector store; it does not perform ingestion or chunking of documents. Option B is wrong because model fine-tuning adapts model weights to a dataset and has nothing to do with splitting documents during indexing. Option D is wrong because the Vector Embeddings API converts text to vectors but does not itself split documents — chunking must happen before embedding, typically via the indexer/skillset pipeline.

Practice this question →

143

MCQeasy

Which Azure AI Foundry feature allows you to visualize the execution path of an agentic workflow?

A.Azure OpenAI Playground.

B.Azure AI Search dashboard.

C.Model catalog view.

D.Prompt Flow visual designer.

AnswerD

Prompt Flow's visual designer renders the agentic workflow as a directed graph, showing each node, tool call and connection along the execution path. This graphical trace lets developers inspect how the agent progressed between steps.

Why this answer

Prompt Flow's visual designer (DAG view) in Azure AI Foundry renders each node (LLM call, Python tool, retrieval step) and the directed edges between them, letting you trace the exact execution path of an agentic workflow. It also surfaces per-node inputs/outputs and token usage, which is why it is the designated tool for visualizing agent orchestration. The other options are single-purpose surfaces that do not expose flow topology.

Exam trap

AI-103 often tests whether candidates confuse observability surfaces — the trap is picking a playground or search dashboard for a question that is really about visualizing multi-step agent orchestration.

How to eliminate wrong answers

Option A is wrong because the Azure OpenAI Playground is only for interactively testing prompts and model parameters against a deployment; it has no concept of multi-step agent graphs. Option B is wrong because the Azure AI Search dashboard reports index statistics, query latency, and relevance metrics — it does not visualize agent execution. Option C is wrong because the Model Catalog is a discovery/browse experience for foundation models and their metadata, not a runtime tracing tool.

Practice this question →

144

Multi-Selectmedium

When implementing Retrieval-Augmented Generation (RAG) using Azure AI Search and Azure OpenAI, which THREE strategies help optimize chunk retrieval relevance and reduce noise? (Choose three)

Select 3 answers

A.Configure hybrid search combining vector embeddings and keyword full-text search.

B.Store all corporate documents in a single unindexed raw text blob without metadata fields.

C.Set the embedding model dimensions to the lowest possible setting to maximize retrieval speed.

D.Implement document chunking strategies with appropriate overlap to preserve context across boundaries.

E.Enable semantic ranking to re-rank search results using deep learning models.

AnswersA, D, E

Hybrid search runs vector similarity and keyword full-text scoring in parallel, then fuses the rankings. Keyword matching catches exact terms and rare tokens that embeddings blur, while vectors capture paraphrase, so combining them raises relevance and suppresses irrelevant chunks in the RAG pipeline.

Why this answer

Option A is correct because Azure AI Search hybrid search runs vector (kNN/ANN) queries and keyword full-text (BM25) queries in parallel and fuses the results with Reciprocal Rank Fusion (RRF), combining semantic similarity with exact term matching to improve relevance and cut noise. Option D is correct because chunking documents into appropriately sized segments with overlap preserves context that would otherwise be lost at chunk boundaries, so embeddings and retrieved passages remain coherent and relevant. Option E is correct because semantic ranking (semantic reranker) applies deep-learning models to reorder the top results, promoting the most semantically relevant chunks and reducing irrelevant hits.

Option B is wrong because storing documents in a single unindexed blob without metadata prevents fielded search, filtering, and vector indexing, which increases noise rather than reducing it. Option C is wrong because reducing embedding dimensions to the minimum sacrifices semantic fidelity and recall; dimension choice should match the model's trained output (e.g., text-embedding-3-large at 3072 or a supported reduced size), not be minimized purely for speed.

Exam trap

AI-103 often tests whether candidates conflate 'faster retrieval' with 'better retrieval' — the trap is choosing lower embedding dimensions or raw blobs thinking they optimize RAG, when they actually destroy relevance.

Practice this question →

145

MCQhard

You are implementing a grounded RAG solution in Azure AI Foundry. Users report that the model occasionally hallucinates answers even when relevant documents are retrieved by Azure AI Search. What is the most effective prompt engineering strategy to mitigate this grounding failure?

A.Remove the system message entirely so the model can freely blend internal training weights with search results.

B.Add strict prompt instructions stating that the model must rely solely on the retrieved context chunks and explicitly output a refusal statement if the answer is not present.

C.Increase the temperature parameter to 1.5 to encourage creative synthesis of the retrieved data.

D.Disable chunking in Azure AI Search so the entire document is passed as a single massive token block.

AnswerB

Explicit grounding instructions constrain generation to the retrieved chunks and mandate a refusal when the answer is absent, directly addressing hallucination despite relevant retrieval. This prompt-level guardrail satisfies the requirement to mitigate grounding failure without changing the search index.

Why this answer

The most effective prompt engineering mitigation for grounding failures is to explicitly instruct the model to answer only from the retrieved context and to refuse when the answer is absent. This constrains the model's generation to the provided evidence and reduces hallucination by giving it a clear escape hatch rather than forcing an answer.

Exam trap

The trap is thinking that more creativity (higher temperature) or more context (no chunking) improves answers, when both actually worsen grounding and increase hallucination in RAG scenarios.

How to eliminate wrong answers

Option A is wrong because removing the system message allows the model to blend internal training knowledge with retrieved context, which increases hallucination rather than reducing it. Option C is wrong because raising temperature to 1.5 increases randomness and creativity, directly worsening hallucination and grounding failures. Option D is wrong because disabling chunking and passing entire documents as massive token blocks dilutes relevant context, increases cost, and can exceed context window limits, making grounding worse rather than better.

Practice this question →

146

MCQmedium

You are building an AI agent in Microsoft Foundry that must answer questions grounded exclusively in a set of internal PDF policy documents. The agent must cite the exact page of the source document in every response, and the documents are updated weekly. You want the least operational overhead while keeping citations accurate. What should you do?

A.Create an Azure AI Search index manually, generate embeddings with a deployment, and wire the index to the agent through a custom function tool.

B.Upload the PDFs to the agent's file store and enable the built-in file search tool, which chunks, embeds, and indexes the documents in a managed vector store.

C.Enable the code interpreter tool and have the agent parse the PDFs at request time to extract text and page numbers.

D.Paste the full text of every PDF into the agent's system instructions so the model can quote the pages directly.

AnswerB

The built-in file search tool in Foundry performs chunking, embedding, and indexing into a managed vector store and returns citation metadata including file and page references. Because the store is managed, weekly updates require only re-uploading or syncing the files, minimizing operational overhead while preserving page-level citations in responses.

Why this answer

The managed file search tool handles chunking, embedding, and vector indexing automatically and returns citation metadata that includes file and page references. Because the index is rebuilt from uploaded files, weekly document refreshes need only file updates rather than custom reindexing pipelines, which satisfies both the accurate-citation requirement and the low-overhead requirement.

Exam trap

The trap here is assuming that a manually built Azure AI Search index is required for page-level citations, when the managed file search tool already returns file and page citation metadata.

Practice this question →

147

Multi-Selecthard

When designing agentic workflows in Azure AI Foundry, what are THREE key characteristics or components of agentic design compared to traditional single-turn prompt completion? (Choose THREE)

Select 3 answers

A.Tool use and external API invocation capabilities

B.Hardcoding every conditional execution path in procedural code

C.Iterative reasoning and self-reflection loops

D.Autonomous planning and task decomposition

E.Executing single stateless prompt completions without memory

AnswersA, C, D

Agents invoke tools and external APIs to act beyond text generation, retrieving live data or triggering operations. This capability distinguishes agentic design from single-turn completion, which only returns a static response with no external side effects.

Why this answer

Option A (Tool use and external API invocation capabilities) is correct because agentic workflows in Azure AI Foundry extend beyond text generation by letting agents call tools, functions, and external APIs (for example via function calling or Azure AI Foundry tool connections) to retrieve data or perform actions. Option C (Iterative reasoning and self-reflection loops) is correct because agents can evaluate intermediate results, critique their own output, and re-plan across multiple reasoning steps rather than producing one final completion. Option D (Autonomous planning and task decomposition) is correct because agentic design centers on breaking a high-level goal into subtasks and deciding the order of execution dynamically, often orchestrated by the model itself.

Option B is incorrect because hardcoding every conditional path is the opposite of agentic design, which relies on model-driven decisions and orchestration rather than fully procedural branching. Option E is incorrect because single stateless prompt completions without memory describe traditional single-turn completion, whereas agentic workflows typically maintain state, context, and memory across turns.

Exam trap

AI-103 often tests whether candidates recognize that agentic design is defined by autonomy, tool use, and iteration, so the trap is selecting a deterministic procedural-coding answer as if it were an agentic characteristic.

Practice this question →

148

Multi-Selectmedium

Which TWO criteria are typically used to evaluate the grounding of an LLM-based application?

Select 2 answers

A.Relevance

B.Latency

C.Token cost

D.Groundedness

E.Model version number

AnswersA, D

Relevance measures how directly retrieved passages address the user's query, filtering out context that is topically adjacent but unhelpful. Grounding evaluation specifically requires this query-to-source alignment, since an answer can be fluent yet unsupported. Relevance therefore satisfies the stem's grounding criterion by verifying the retrieved evidence actually pertains to what was asked.

Why this answer

Option A, Relevance, is correct because grounding evaluation checks whether the model's response actually addresses the user's query using the retrieved context, so relevance measures how well the answer aligns with the question and the supplied source material. Option D, Groundedness, is correct because it directly measures whether the generated statements are supported by, or entailed by, the provided reference documents rather than being hallucinated or drawn from the model's parametric memory. Together, relevance and groundedness are the two standard quality dimensions for assessing retrieval-augmented or otherwise grounded LLM applications.

The unmarked options do not belong: Latency (B) and Token cost (C) are operational efficiency metrics, not grounding quality criteria, and Model version number (E) is a configuration identifier that says nothing about whether an answer is faithful to its sources.

Exam trap

AI-103 often tests whether candidates distinguish quality/grounding metrics from operational metrics like latency, cost, or version numbers, which are commonly mixed into answer choices as distractors.

Practice this question →

149

MCQeasy

Which component in Azure AI Foundry allows you to visualize and debug the execution path of a model call, including input/output mapping?

A.Prompt Flow

B.Compute Instance

C.Model Benchmarks

D.Deployment Endpoint

AnswerA

Prompt Flow in Azure AI Foundry builds a directed graph of nodes, letting you trace each step's inputs and outputs and debug the model call's execution path. This visual tracing directly satisfies the requirement to inspect input/output mapping, which a plain deployment endpoint cannot show.

Why this answer

Prompt Flow in Azure AI Foundry is the orchestration and authoring tool that lets you build flows as DAGs of nodes (LLM, Python, prompt, tool) and visually inspect each node's inputs/outputs, execution time, and token usage. It is purpose-built for debugging and tracing the execution path of a model call, including input/output mapping between nodes.

Exam trap

AI-103 often tests the confusion between Prompt Flow (authoring/debugging/tracing) and deployment endpoints or benchmarks — candidates must know Prompt Flow is the visualization and debugging layer, not the serving or evaluation layer.

How to eliminate wrong answers

Option B is wrong because a Compute Instance is just the VM that hosts the development environment (notebooks, VS Code) — it provides compute, not visualization of execution paths. Option C is wrong because Model Benchmarks evaluate and compare model quality/performance metrics; they do not trace a single call's execution path or input/output mapping. Option D is wrong because a Deployment Endpoint is the runtime URL that serves the model for inference — it exposes the model but does not visualize or debug the flow's internal execution.

Practice this question →

150

MCQmedium

You are configuring a Prompt Flow to use a custom Python tool. Which configuration is required to ensure the environment has the necessary libraries?

A.Install them manually on the host machine.

B.Include them in a 'requirements.txt' file in the flow directory.

C.Add them to the System Prompt.

D.Add them to the deployment manifest.

AnswerB

Placing a requirements.txt file in the flow directory lets Prompt Flow resolve and install the declared Python packages into the flow's runtime environment during execution. This directly satisfies the stem's constraint that the custom Python tool has its necessary libraries available, since dependencies are provisioned automatically rather than assumed present.

Why this answer

Prompt Flow resolves Python dependencies for a flow by reading a requirements.txt file located in the flow directory. This file lists the packages and versions needed by custom Python tools, and the Prompt Flow runtime installs them when the flow is executed or built. This ensures reproducibility across local development and cloud execution.

Exam trap

AI-103 often tests whether candidates confuse prompt-level configuration (system prompt) with environment-level configuration (requirements.txt), leading them to pick the system prompt option.

How to eliminate wrong answers

Option A is wrong because manually installing libraries on the host machine does not guarantee the same environment in the Prompt Flow runtime or when the flow is deployed, breaking reproducibility. Option C is wrong because the system prompt is natural-language instruction text sent to the model and has no role in Python package installation. Option D is wrong because the deployment manifest describes how the flow is hosted (endpoint, compute, etc.), not the Python dependency set.

Practice this question →