Free AI-500 practice test

Option B is correct because Zero Trust requires least privilege and identity segregation; each agent having its own Managed Identity ensures that if one agent is compromised, the attacker cannot access tools, databases, or resources assigned to other agents. Option A and D are incorrect because sharing a single high-privilege identity creates a catastrophic single point of failure and enables unrestricted lateral movement. Option C is incorrect because hardcoded API keys lack automated lifecycle management, rotation, and fine-grained Azure RBAC enforcement.

Option A is correct because a clean separation of concerns isolates the internal reasoning agent (which maintains an unredacted scratchpad in private working memory) from a synthesizer/response agent that translates conclusions into clean, approved user-facing text. Option B is insecure because hiding text via CSS transmits confidential data over the wire to the client DOM. Option C degrades reasoning accuracy significantly. Option D creates a major data exfiltration vulnerability.

Option A is correct because a Human-in-the-Loop (HITL) breakpoint halts the execution loop at a deterministic gate, persists the state to durable storage (e.g., Cosmos DB), and waits for an asynchronous human approval signal before proceeding to execute financial tools. Option B is incorrect because prompt instructions are probabilistic and vulnerable to hallucination or jailbreaking; compliance boundaries must be enforced deterministically in the control loop. Option C is incorrect because running two LLMs in parallel does not provide human oversight or fulfill regulatory sign-off requirements. Option D is incorrect because Content Safety filters block harmful content, not valid financial loan figures.

Option A is correct because Semantic Kernel uses the @kernel_function decorator (or [KernelFunction] in C#) along with docstrings and type annotations to inspect parameter types, descriptions, and return schemas, exposing them as native tools to the LLM. Option B is incorrect because Flask routes expose HTTP endpoints, not in-process Semantic Kernel native plugins. Option C is incorrect because function naming conventions do not register tools in Semantic Kernel. Option D is incorrect because shell registration is not how native functions are bound in Semantic Kernel.

Option B is correct because Hybrid Search combines the strengths of BM25 (ideal for exact keyword, SKU, and part-number matches) and dense vector search (ideal for conceptual semantic similarity), while RRF normalizes scores and the cross-encoder Semantic Reranker re-orders top results for contextual relevance. Option A misses exact alphanumeric strings that lack rich vector embeddings. Option C fails on conceptual or synonym-heavy queries. Option D is an unindexed sequential scan.

Option A is correct because layout-aware / hierarchical chunking understands document structure (Markdown, HTML, or PDF layout analysis), keeping entire tables intact and indexing child chunks while maintaining links to parent sections for full grounding. Option B further fractures table rows across tiny chunks. Option C exceeds context limits and causes extreme retrieval latency. Option D discards vital technical specification data.

Option A is correct because the MCP specification defines two transport mechanisms: stdio (for local in-process/CLI tools) and SSE over HTTP (for remote, networked microservices hosted on platforms like Azure Container Apps or App Services). Option B is incorrect because stdio is for local process pipes, not remote web services. Option C is incorrect because UDP is unreliable and not part of the MCP specification. Option D is outdated and unrelated to agent tool protocols.

Option A is correct because structural demarcation (using XML tags or clear delimiters) combined with explicit system instructions anchoring the boundary between instructions and untrusted data is the foundational prompt engineering defense against indirect injection. Option B has no defensive impact on prompt injection. Option C is ineffective against attackers. Option D obfuscates the prompt from the model without preventing execution.

Option B is correct because Azure OpenAI Structured Outputs guarantees 100% adherence to the supplied JSON Schema via constrained decoding at the model inference layer, eliminating JSON syntax errors and missing fields. Option A is probabilistic and prone to occasional formatting failures. Option C requires code execution sandboxes and introduces security risks. Option D destroys JSON brackets, commas, and structural delimiters.

Option A is correct because LangGraph uses conditional edges (graph.add_conditional_edges) where a router function inspects the shared state (e.g., the last model message or intent classifier) and returns the string identifier of the next node to execute. Option B is incorrect because static edges define fixed linear transitions, not dynamic conditional branching. Option C is incorrect because exception blocks handle runtime errors, not deliberate routing logic. Option D is incorrect because HTTP headers do not control in-memory LangGraph node transitions.

Option A is correct because placing Azure API Management (APIM) in front of multiple Azure OpenAI regional deployments with intelligent load-balancing and retry logic dynamically distributes token consumption (TPM/RPM) across regions, mitigating HTTP 429 throttling during peak volume. Option B harms customer business operations. Option C prevents the model from generating reasoned answers. Option D dramatically degrades system latency without solving regional quota limits.

Option A is correct because the W3C traceparent header is the industry standard for distributed tracing; propagating it across HTTP boundaries, gRPC, and message brokers enables Azure Monitor and Application Insights to correlate all subagent operations and tool calls into a single distributed flame graph. Option B provides authentication. Option C manages response compression. Option D manages HTTP caching behavior.

Option A is correct because Groundedness (also called Faithfulness) specifically measures whether every factual claim in the generated answer is directly derived from and substantiated by the retrieved context provided in the prompt, flagging hallucinations. Option B measures grammatical correctness and readability. Option C measures structural logical flow. Option D measures response generation speed, not factual grounding.

Option A is correct because tagging requests with department metadata or using dedicated Azure API Management (APIM) subscription keys linked to corporate cost centers allows Azure Cost Management and Azure AI Foundry to accurately attribute token usage and bill costs to specific business units. Option B causes administrative overhead and quota fragmentation. Option C is inaccurate and non-compliant with financial accounting standards. Option D arbitrarily restricts enterprise adoption.

Option A is correct because Tool Selection Accuracy specifically evaluates the agent's decision-making in selecting appropriate tools from the tool catalog and passing arguments that satisfy the required parameter schemas. Option B, C, and D are infrastructure or connectivity issues that would manifest as HTTP 5xx errors or connection timeouts, not a drop in tool selection reasoning accuracy.

Option A is correct because the Acceptance stage in an AI DTAP pipeline validates business and safety readiness through automated evaluations (achieving target benchmark scores on Groundedness, Relevance, etc.) and comprehensive adversarial red teaming prior to production approval. Options B, C, and D do not constitute rigorous acceptance gating.

Option A is correct because Infrastructure as Code (IaC) using declarative frameworks like Azure Bicep or Terraform ensures repeatable, auditable, and version-controlled provisioning of all AI resources and role assignments across environments (Dev, Test, Prod). Options B, C, and D are error-prone, non-auditable, and violate enterprise governance standards.

Option A is correct because Azure Key Vault provides hardware-backed, encrypted secrets management with automated rotation and fine-grained Azure RBAC; the agent authenticates using its Managed Identity, ensuring credentials never touch source code or disk in plaintext. Options B, C, and D expose critical credentials to compromise.

Option A is correct because defending against Indirect Prompt Injection requires evaluating third-party retrieved text using Azure AI Content Safety Prompt Shields (specifically the Indirect Attack detection model) before that untrusted content is assembled into the LLM prompt context. Option B is too late: the model may have already executed malicious tools. Option C does not protect backend RAG pipelines. Option D is unrelated.

Option A is correct because Groundedness ensures factual integrity and absence of hallucinations; dropping below the quality gate threshold (e.g., 4.5/5.0) indicates that the revised prompt caused the agent to fabricate unsupported claims, warranting an automated PR block. Options B and C are performance improvements, not regressions. Option D is an administrative git metadata item.