Microsoft AI-103: Implement generative AI and agentic solutions Practice Questions

A Thread is correct because Threads are the stateful conversation containers in Azure AI Foundry Agent Service — they store message history, file attachments, and intermediate results independently per conversation. Creating a new Agent per user is incorrect and wasteful; an Agent defines the instructions and tools configuration and is meant to be reused across many conversations. A Run is incorrect because a Run is a single invocation of the agent on a Thread; it is not the container for ongoing conversation state. A Deployment is not a Foundry Agent Service construct for conversation isolation; it refers to model deployments in Azure AI Foundry.

Azure AI Content Safety content filters are natively integrated with Azure OpenAI deployments and can be configured to block or flag harmful content in both prompt inputs and model completions. Azure Policy enforces resource governance rules but does not filter model inputs/outputs. The Responsible AI dashboard in Azure Machine Learning is an evaluation tool for model fairness and interpretability, not a runtime content filter. Azure Defender for AI (Microsoft Defender for Cloud) provides threat detection for AI workloads but does not perform prompt/completion content filtering.

Azure AI Content Safety provides an independent guardrail layer that scans both user inputs (for injection attempts) and model outputs (for policy violations), catching jailbreaks the model itself might miss — this is a defense-in-depth approach. Re-asserting the safety constraints in every system prompt (meta-prompt reinforcement) counteracts multi-turn drift where the model may lose track of early instructions over long conversations. Increasing temperature makes outputs more random but does not enforce safety constraints. Appending safety instructions to user messages is less authoritative than the system prompt and can be overridden by user content that follows. Downgrading to GPT-4o-mini reduces capability but also reduces instruction adherence — it does not systematically improve safety. Removing the system prompt and relying solely on fine-tuning is risky: fine-tuning does not guarantee safety behavior and removes the most direct mechanism for enforcing runtime constraints.

Document-aware chunking exploits the inherent structure of FAQ documents to produce chunks that are exactly one complete Q&A pair, ensuring semantic self-containment and a natural retrieval unit. Fixed-size chunking with overlap may split a question from its answer or merge multiple Q&A pairs into one chunk, breaking semantic boundaries. Sentence-level chunking would split answers mid-thought and separate questions from their answers. Recursive character text splitting is a general heuristic that does not leverage the explicit Q&A structure of the documents.

A maximum iteration limit is a fundamental safety valve in any agentic loop — it guarantees termination regardless of model behavior. Detecting repeated identical tool calls and short-circuiting (returning cached results or escalating) breaks cycles caused by the model getting stuck on the same sub-problem. Requiring the final answer turn to use structured outputs forces the model into a definitive completion schema, preventing it from emitting another tool call when it should be concluding. Increasing max_tokens gives the model more tokens to generate but does not prevent it from continuing to call tools indefinitely — it may actually worsen the problem. Setting tool_choice to "auto" (vs. "required") is a mild mitigation but does not prevent loops — the model can still call tools repeatedly in auto mode. Removing all tools after the first call is too aggressive — it prevents the model from using tools it may legitimately need in steps 2 and 3, breaking the intended multi-step workflow.