Free Microsoft Developing AI Apps and Agents on Azure AI-103 Exam Questions

The solution does not fully meet the goal. A prompt shield for documents is the correct control for the embedded-instruction portion of the scenario. Microsoft defines Prompt Shields as protection against prompt manipulation, including attacks embedded in third-party or document-like content that is supplied to a generative model. OCR-extracted text from uploaded images is untrusted contextual content, so document attack protection is appropriate for detecting hidden instructions that attempt to override the model's intended behavior.

However, the scenario contains two separate risks: unsafe image uploads and hidden instructions embedded in images. Prompt Shields for documents address indirect prompt injection, but they do not classify or block harmful visual content in the uploaded image itself. Azure AI Content Safety image moderation is the control that scans images for harmful content categories such as sexual content, violence, hate, and self-harm with severity levels that can be used for blocking decisions.

Therefore, document prompt shielding alone is incomplete. A complete mitigation would combine image moderation for unsafe images with Prompt Shields for document attacks, and optionally Spotlighting for lower-trust third-party content. Reference topics: Content Safety image moderation, Prompt Shields, document attacks, indirect prompt injection, and multimodal safety.

The correct choice is to use a model cascade that routes the requests to different models. In Microsoft Foundry, this pattern aligns with model routing: simple, low-risk prompts can be handled by smaller, faster, lower-cost models, while complex prompts can be escalated to more capable or reasoning models. Microsoft's Foundry model router guidance states that the router optimizes cost and latency while maintaining comparable quality by using smaller, cheaper models when they are sufficient and larger or reasoning models when the task requires more advanced capability.

This directly matches the scenario: most traffic consists of simple FAQs, so routing those requests to efficient models reduces average latency and token-processing cost. Advanced reasoning requests still receive high-quality responses because they are routed to models with stronger reasoning capability. Microsoft's model router documentation also explains that routing decisions consider prompt difficulty, cost, quality, latency, and conversation context, making it suitable for diverse chat workloads.

Increasing max_tokens for all requests would usually increase cost and latency. Sending all requests to a smaller model risks poor quality for complex questions, while sending all requests to the most capable model wastes cost and latency on simple FAQs. Reference topics: Microsoft Foundry model routing, model selection, generative AI optimization, latency management, and cost-aware AI application design.

The correct answer is B. Personally Identifiable Information (PII) Detection. The case study states that Agent1 must never reveal customer information, even if a document containing customer data is added accidentally to the product sheet repository in storage1. This is a privacy and compliance control requirement, so the appropriate capability is PII Detection.

Azure Language PII Detection is a Foundry Tools capability that identifies, classifies, and redacts sensitive information across text, conversations, and native documents. Microsoft states that PII Detection can be used to implement privacy controls, reduce sensitive data exposure, and support compliance requirements. In this scenario, PII Detection should be applied to retrieved product-sheet content and generated responses so customer names, contact details, identifiers, and other sensitive values are not exposed to users.

Prompt Shields are important for a separate requirement: protecting Agent1 from malicious instructions hidden in documents or embedded text. Microsoft describes Prompt Shields for documents as protection against hidden instructions embedded in external content. However, the option that directly satisfies the requirement to prevent disclosure of customer information is PII Detection. Self-harm and violence filters address harmful-content categories, not privacy leakage.

The correct configuration is advanced data parsing because the issue is not merely OCR; the ingestion job must preserve document structure for reliable RAG retrieval. Microsoft guidance for advanced parsing states that it automatically detects tables across all pages, including tables in scanned documents, merges tables that span multiple pages, restores column headers, and creates table chunks with metadata such as table index, shape, page numbers, section headings, and table previews. This directly satisfies the requirement to retrieve specific rows from multipage tables while retaining source-page context.

Basic parsing with fixed-size chunking would flatten the document into arbitrary text fragments, which is the current failure mode. OCR with page-level chunking improves text extraction from scanned PDFs, but it does not provide structure-aware chunks that preserve headings and table relationships across pages. Storing each page as a single chunk is too coarse for row-level retrieval and can bury relevant table rows in excessive context. Advanced data parsing is purpose-built for RAG ingestion because it produces semantically meaningful, retrievable chunks and enriches them with metadata needed for citations and grounding. Reference topics: RAG ingestion, advanced parsing, OCR, table extraction, structure-aware chunking, page metadata, and Azure Blob Storage document ingestion.

The correct answer is C because the requirement is structured field extraction from invoices across varying templates, not only OCR or layout preservation. Azure Content Understanding analyzers are reusable configurations that combine content extraction, AI-powered analysis, and structured data output, and Microsoft states that custom analyzers can be created for specific extraction needs. In this case, the analyzer schema should define fields such as invoice number, invoice date, vendor name, and total amount so the output can be returned as structured JSON for downstream RAG grounding.

The confidence-routing requirement also points to Content Understanding field confidence scores. Microsoft documentation states that every field can include a confidence score from 0 to 1, and that confidence scores can be used to automate high-confidence results while routing low-confidence results for human review. A threshold such as 0.80 is therefore an application routing rule based on the returned field confidence. The prebuilt-layout analyzer preserves layout but does not define invoice-specific business fields. Groundedness guardrails evaluate generated answers, not invoice field extraction. Azure AI Search search.score measures retrieval relevance, not extraction confidence. Reference topics: Content Understanding custom analyzers, document field extraction, structured JSON output, confidence scoring, and RAG grounding.

Yes, the solution meets the goal. The problem is not retrieval availability, because the required regulatory clauses are already present in the retrieved policy documents. The failure occurs during generation: the agent produces a summary that omits required content. A reflection pass is the correct application-level control because it adds a verification step before the response is returned. The pass can compare the draft answer against the retrieved clauses, detect missing mandatory content, and trigger regeneration or revision until the summary includes the required clauses.

This aligns with Microsoft Foundry's evaluation and observability model, where generated responses are assessed for reliability, groundedness, relevance, and quality throughout the AI application lifecycle. Foundry observability guidance describes evaluation as a mechanism for measuring response quality and improving AI outputs across development and production workflows. The Azure AI evaluation SDK also defines completeness as the extent to which a generated response contains all necessary and relevant information with respect to the provided ground truth. Reflection operationalizes that quality check inside the application flow, rather than merely reporting the defect after the fact. Reference topics: model reflection, response completeness, RAG generation quality, retrieved context verification, and agent response optimization.

The correct capability is token usage. In Microsoft Foundry observability, token consumption is the primary signal for diagnosing model-cost changes when request volume is unchanged. Token usage lets you distinguish whether costs increased because prompts became larger, retrieved or tool-provided context expanded, responses became longer, or agent execution added more model calls. Microsoft Foundry monitoring dashboards track operational metrics such as token consumption, latency, error rates, and quality scores, and the agent monitoring dashboard is specifically intended to help analyze token usage, latency, success rates, and evaluation outcomes for production traffic.

This directly matches the scenario because the issue is not more traffic, but changed request or response characteristics. Input tokens reveal whether the prompt, chat history, grounding data, or tool outputs being sent to the model increased. Output tokens reveal whether the model is generating longer completions. Expanded tool usage can also increase cost indirectly by adding more tool results, intermediate calls, and context into subsequent model requests; Foundry tracing and observability capture tool usage and token consumption for agent runs.

Evaluation metrics assess response quality and safety, not cost drivers. Latency identifies performance delays, and run success rate measures reliability. Reference topics: Microsoft Foundry observability, agent monitoring dashboard, token consumption, cost analysis, tool usage, and production monitoring.

The correct answer is D. prompt shields for documents. The OCR text is extracted from uploaded images and appended as additional context, so it is third-party content rather than a direct trusted user instruction. Microsoft Foundry Prompt Shields distinguish between user prompt attacks, which are malicious instructions directly supplied as user prompts, and document attacks, which are hidden or embedded instructions in third-party content such as documents, emails, webpages, or grounded data. Microsoft also notes that Prompt Shields analyze indirect attacks embedded in input documents or images.

This scenario is an indirect prompt injection pattern: an uploaded screenshot may contain text that says to ignore the system prompt or perform unauthorized actions. Because the OCR output is being passed to the multimodal model as contextual content, the appropriate protection is Prompt Shields for documents, which scans externally sourced context for malicious embedded instructions before generation. Protected material text detects known copyrighted text in model outputs, not prompt injection. Image moderation detects harmful visual content categories, not malicious instructions in extracted context. Prompt Shields for user prompts are less precise here because the risk comes from document-like content derived from the uploaded image. Reference topics: Prompt Shields, document attacks, indirect prompt injection, multimodal safety, OCR-derived context, and Foundry guardrails.

The correct answer is C because the requirement is a localized image edit: remove only the competitor logo while preserving the rest of the already generated image. Azure OpenAI image editing is designed for modifying existing images based on a text instruction, rather than regenerating the entire image from scratch. Microsoft's Azure OpenAI image guidance states that the Image Edit API modifies existing images and requires an input image as part of the request. In a mask-based inpainting workflow, the mask identifies the exact region to change, allowing the model to replace only the logo area while retaining surrounding background, composition, lighting, and product content.

Increasing prompt guidance strength would affect adherence during generation, but it would not safely remove a specific logo from a completed image. Modifying the original prompt and regenerating may create a different image and does not guarantee preservation of the approved visual content. Rerunning with a different random seed also changes the image unpredictably and may introduce new brand or legal issues. Mask-based inpainting is the minimal-change remediation method for post-generation brand cleanup. Reference topics: Azure OpenAI image editing, inpainting, mask-guided edits, image generation governance, and computer vision solutions.

The correct answer is agentic Retrieval Augmented Generation (RAG) because the requirements describe the agentic retrieval pipeline in Azure AI Search. Agentic retrieval is designed for chat and copilot scenarios where a user's request can be complex, conversational, and dependent on prior turns. Azure AI Search agentic retrieval uses an LLM-assisted planning stage to break a complex request into focused subqueries, allowing the system to retrieve grounding information from multiple chunks rather than relying on a single query path. Microsoft's Azure AI Search guidance describes agentic retrieval as a multi-query pipeline for complex questions in chat and agent workflows, with subqueries that can include chat history for additional context.

This also satisfies the latency requirement because agentic retrieval runs the generated subqueries in parallel and then merges and reranks the best results for use by the generative model. Classic RAG is simpler and typically sends a single query to search, making it less suitable for multi-hop or conversational retrieval planning. Chain of thought is a reasoning technique, not an Azure AI Search retrieval approach, and iterative retrieval does not specifically provide the built-in query planning, conversation-aware retrieval, and parallel execution described here. Reference topics: Azure AI Search agentic retrieval, RAG with Azure AI Search, knowledge bases, query planning, and generative AI grounding.