Azure AI Apps and Agents Developer (AI-103) practice questions and exam guide

An engineer holds Contributor on a Foundry resource but cannot grant a colleague access to it. What explains this, and what is the correct remedy?

1. Contributor excludes role assignment; grant User Access Administrator or use Owner
2. Role assignments are blocked at the resource scope and must be made at the tenant root
3. The colleague must first accept an invitation before any role can be assigned
4. Contributor works only after the resource's key authentication has been disabled

Answer: A — Contributor excludes role assignment; grant User Access Administrator or use Owner

A) Correct — Contributor deliberately withholds the ability to manage access, so granting rights requires User Access Administrator, Owner or the equivalent role-based access administrator role. B) Role assignments are perfectly valid at resource scope; nothing forces them to the tenant root. C) Invitation acceptance applies to external guests and is unrelated to this permission failure. D) Authentication mode on the resource has no bearing on who may create role assignments.

The Face Identify and Verify operations in Azure Vision in Foundry Tools require:

1. Nothing beyond a resource key; any caller may use them
2. A free tier resource, because the operations are not billed
3. Limited Access approval with responsible AI attestations
4. A GPU-backed compute cluster deployed in the same region

Answer: C — Limited Access approval with responsible AI attestations

C) Identification, verification, liveness and several attribute features sit behind Limited Access, so you register the use case and attest to the responsible AI terms. A) A key alone does not unlock the gated operations. B) Tier and gating are unrelated. D) The service is fully managed, so you bring no compute.

An app calling Azure Language in Foundry Tools suddenly gets HTTP 429 responses. First action?

1. Recreate the resource so its counters are reset to zero
2. Check the tier's rate limit, then back off and retry
3. Move to the free tier, which has more headroom for spikes
4. Delete diagnostic logs to reduce load on the endpoint

Answer: B — Check the tier's rate limit, then back off and retry

B) A 429 means throttling: confirm the transaction rate limit for the pricing tier, honour the Retry-After header with exponential backoff, and raise the tier or split the load if the ceiling really is too low. A) Recreating does not raise the limit and discards configuration. C) The free tier has the tightest limits of all. D) Logging is not what triggers throttling.

A model deployment must be reachable only from the company's virtual network. What should be configured?

1. Rotate a longer API key weekly and store it in a secrets vault instead
2. Require a CAPTCHA challenge before the inference endpoint will respond
3. Configure private endpoints and disable public network access entirely
4. Allow only approved user-agent strings on requests reaching the service

Answer: C — Configure private endpoints and disable public network access entirely

C) Right — a private endpoint puts the service on the virtual network, and disabling public network access removes the internet-facing path. A) A stronger key still answers requests from anywhere. B) CAPTCHAs guard human web flows, not machine API traffic. D) User-agent headers are trivially forged and are not isolation.

Which pairing is the standard stack for retrieval-augmented generation at scale?

1. A frontier chat model paired with a relational SQL table
2. A text embedding deployment with a vector index in Azure Search
3. An image generation model with a document database container
4. A speech transcription model with a blob storage container

Answer: B — A text embedding deployment with a vector index in Azure Search

B) The embedding deployment turns chunks and queries into vectors, and Azure Search in Foundry Tools stores them and serves nearest-neighbour, hybrid and filtered queries with semantic ranking. A) A chat model does not emit embeddings and a SQL table has no vector search. C) Image generation produces pictures, not retrievable text vectors. D) Transcription and blob storage cover ingestion, not retrieval.

Prompt Shields in Azure AI Content Safety protect against what?

1. Volumetric denial-of-service floods against the endpoint
2. Injected instructions and jailbreaks in user text
3. SQL injection reaching a backend relational database
4. Cross-site scripting rendered in the chat client browser

Answer: B — Injected instructions and jailbreaks in user text

B) Prompt Shields classify user prompts and grounding documents for attempts to override the system instructions, including indirect injection hidden in retrieved content or in text embedded in an image. A) Volumetric attacks are handled by DDoS Protection at the network layer. C) Parameterized queries stop SQL injection. D) Output encoding and a web application firewall stop cross-site scripting.

Setting temperature to 0 on a chat completion means:

1. Sampling randomness is at its maximum for every token
2. Decoding is greedy, taking the most probable token
3. The deployment is disabled until temperature is raised
4. The response is capped at a very small token budget

Answer: B — Decoding is greedy, taking the most probable token

B) At 0 the sampler always takes the highest-probability token, giving the most reproducible output, which is the usual choice for extraction and classification. A) Randomness rises with temperature, so 0 is the opposite end. C) Temperature never disables a deployment. D) Output length is governed by the maximum output tokens parameter.

Which Azure AI Content Safety configuration runs BEFORE the model receives a user message?

1. Groundedness checks over the generated answer and its citations
2. Prompt shields and harm filters applied to the user message
3. Translation of the user message into the model's base language
4. Embedding of the user message for retrieval against the index

Answer: B — Prompt shields and harm filters applied to the user message

B) Prompt shields and input harm filtering are evaluated on the incoming prompt, so an attack or disallowed request never reaches the model. A) Groundedness can only run once output exists. C) Translation is a language task, not a safety gate. D) Embedding supports retrieval and enforces nothing.

A developer wants an agent to answer questions from the company's own documents. Which pattern applies?

1. Index the documents and ground the agent's replies in retrieved content
2. Raise the model's temperature so it recalls more of its training detail
3. Rename each document so its file name matches expected user questions
4. Fine-tune the base model on a large corpus of public web page content

Answer: A — Index the documents and ground the agent's replies in retrieved content

A) Right — retrieval-augmented generation grounds answers in passages fetched from an index of the private corpus, and it stays current as documents change. B) Temperature controls randomness, not what the model knows. C) File names convey none of the document content. D) Public-data fine-tuning teaches nothing about internal documents.

A finance agent can issue refunds. The team must guarantee a person signs off before any refund is actually paid. Which design MOST directly meets the requirement?

1. Instruct the agent in its system text to always ask the user before refunding
2. Log every refund tool call to Azure Monitor and review the logs each morning
3. Lower the model temperature so the agent rarely selects the refund tool
4. Require an approval gate on the refund tool so execution pauses for sign-off

Answer: D — Require an approval gate on the refund tool so execution pauses for sign-off

D) Correct — an approval gate is enforced by the runtime: the tool call is suspended until an authorised human approves, so no prompt-level failure can bypass it. A) Instructions are probabilistic guidance and can be overridden by clever or adversarial input. B) After-the-fact log review detects the payment but cannot prevent it. C) Temperature changes sampling, not authorisation, and a low-temperature model can still be confidently wrong.

Function and tool calling in Azure OpenAI in Foundry Models lets the model do what?

1. Generate images from a text prompt in the same request
2. Emit structured arguments for a tool schema you declared
3. Produce embedding vectors for downstream similarity search
4. Retrain itself on the transcript of the current session

Answer: B — Emit structured arguments for a tool schema you declared

B) You supply a JSON schema per tool; the model returns a call whose arguments match it, your code executes the tool and returns the result, which is the basis of agent behaviour and of the Responses API tool loop. A) Image generation is a different model and endpoint. C) Embeddings come from an embedding deployment. D) Models do not retrain from a conversation.

During a turn, an agent's tool returns an error object describing a missing required field. What is the MOST useful thing to do with that error?

1. Return the error to the model as the tool result so it can correct the call
2. Discard it silently and let the model answer from whatever it happens to know already
3. Convert it into a user-facing message and end the conversation turn there
4. Retry the identical call unchanged, since transient errors usually clear up

Answer: A — Return the error to the model as the tool result so it can correct the call

A) Correct — feeding a structured error back lets the model repair the arguments and continue, which is the standard self-correction loop for tool calling. B) Suppressing the error invites an answer built on nothing, which is how fabrications enter. C) Ending the turn abandons a recoverable situation and pushes the work back to the user. D) A missing-field error is deterministic, so an identical retry fails identically.

A retailer processes millions of product photos nightly and needs only a stable list of object tags and a caption per image, at the lowest cost. Which choice is MOST appropriate?

1. A multimodal model prompt per image asking for tags and a caption in JSON
2. An image-generation call configured to describe rather than create an image
3. A video-generation pipeline that ingests the photos as single-frame clips
4. A direct call to the vision service's image analysis capability for each photo

Answer: D — A direct call to the vision service's image analysis capability for each photo

D) Correct — when the requirement matches a purpose-built capability, the dedicated vision call is cheaper and more predictable at scale than generative inference. A) A multimodal prompt is flexible but costs far more per image and varies in output shape. B) Image generation synthesises pixels; it is not a description endpoint. C) Wrapping stills as video adds cost and latency for no analytical benefit.

What is a valid use of a multimodal chat model's image input in Foundry Models?

1. Synthesizing spoken audio from a written script supplied with the image
2. Training a custom image classifier from a labeled set of sample pictures
3. Serving as a drop-in replacement for document OCR at production scale
4. Passing an image with text and reasoning over both to answer or extract

Answer: D — Passing an image with text and reasoning over both to answer or extract

D) Right — multimodal models accept image and text in the same prompt and reason jointly over them. A) Speech synthesis is an Azure Speech in Foundry Tools capability. B) Classifier training is a separate discipline, not prompt-time inference. C) High-volume document OCR belongs to Azure Document Intelligence in Foundry Tools.

The caption feature of Image Analysis is designed to return:

1. A multi-paragraph essay describing everything in the scene
2. A tag list only, with no sentence-level description at all
3. A JSON array of raw RGB pixel values for the whole image
4. One concise sentence, with dense captions for image regions

Answer: D — One concise sentence, with dense captions for image regions

D) Caption returns a single human-readable sentence for the image, and dense captions add one sentence per detected region. A) It is deliberately short. B) Tags are a separate feature. C) Pixel data is never returned by the analyze call.

An insurance app sends a photo of a damaged vehicle plus the claim text to a model and asks for a structured damage summary. Which capability is being used?

1. Multimodal understanding, where image and text are reasoned over together
2. Image generation, where the model synthesises a repaired version of the car
3. Optical character recognition, which extracts the text printed on the vehicle
4. Speech transcription, which converts the adjuster's dictation into claim text

Answer: A — Multimodal understanding, where image and text are reasoned over together

A) Correct — supplying an image and text in the same prompt and asking for a joint conclusion is multimodal understanding. B) Nothing is being synthesised; the task is analysis of an existing photo. C) OCR would only surface incidental text such as a plate and could not assess damage. D) No audio is involved in the described flow.

A company translates user-generated forum posts and needs profane words masked rather than removed in the output. Which Azure Translator in Foundry Tools configuration achieves this?

1. Set the profanity action to mark with a tag so the client can strip the wrapped words
2. Set the profanity action to delete, which is the only supported non-default behavior
3. Set the profanity action to mask, which replaces the characters with asterisks
4. Leave the default action, which already masks profanity in all target languages

Answer: C — Set the profanity action to mask, which replaces the characters with asterisks

C) Correct — masking replaces the offending characters with asterisks while keeping the word position in the sentence, which is what "masked rather than removed" asks for. A) is a real alternative action that wraps the term in a marker, but it delegates the masking to the client instead of performing it. B) is a real action yet it removes the word, and it is not the only option. D) inverts the default — profanity is passed through untouched unless you request an action.

A multilingual intake pipeline routes each document to a language-specific processor. Some submissions are very short or contain mixed scripts. Which statement about language detection is MOST accurate for designing this pipeline?

1. The service returns one predicted language plus a confidence score per document
2. The service returns every language present, each with its character offsets
3. Detection requires a country hint, without which the call is rejected
4. Short inputs are rejected outright, so the caller must pad them before submitting

Answer: A — The service returns one predicted language plus a confidence score per document

A) Correct — the detection response gives the predicted language with a confidence value, which is exactly the signal a routing pipeline should threshold on when input is short or mixed. B) tempts because mixed-script documents make per-span detection sound natural, but the feature reports a document-level prediction rather than segmented ranges. C) reverses an optional hint into a requirement. D) is a misconception: short input is accepted, it simply tends to yield lower confidence.

Conversation summarization is most useful for:

1. Turning call centre transcripts into issues and resolutions
2. Producing one-sentence captions for uploaded product images
3. Identifying which enrolled speaker is talking in a recording
4. Extracting printed text from the scanned pages of a contract

Answer: A — Turning call centre transcripts into issues and resolutions

A) The conversation aspects understand dialogue turns and produce issue and resolution summaries suited to support transcripts. B) Captioning is a vision feature. C) Speaker identification is a speech feature. D) Text extraction from scans is OCR.

Sentiment analysis in Azure Language in Foundry Tools returns at minimum:

1. Sentence and document sentiment with confidence scores
2. Translated text in each of the requested target languages
3. Speaker labels aligned to the segments of an audio file
4. Vector embeddings of each sentence in the input document

Answer: A — Sentence and document sentiment with confidence scores

A) Each sentence is scored and the document label is derived from those sentence scores, with confidence values for positive, neutral and negative. B) Translation is a different service. C) Speaker labels come from speech processing. D) Embeddings are produced by a model deployment, not this operation.

A regulated insurer processes 200 pages a day and must show an auditor which page and location each extracted value came from. Which capability MOST directly satisfies the audit requirement?

1. The bounding region and page number returned alongside each extracted field
2. The document-level confidence score returned for the analysis operation
3. The markdown rendering of the document, which preserves the original page breaks
4. The model version identifier recorded in the analysis response envelope

Answer: A — The bounding region and page number returned alongside each extracted field

A) Correct — extraction results carry the page and the bounding region of the source span, which is precisely the provenance an auditor needs to trace a value back to the document. B) speaks to certainty, not to location. C) tempts because page breaks are preserved, but a rendering does not tie an individual extracted value to a coordinate. D) supports reproducibility of the pipeline but says nothing about where a given value appeared.

What does a composed model in Azure Document Intelligence in Foundry Tools do?

1. It restricts analysis to the prebuilt receipt model and its field schema
2. It supersedes the layout model for table and selection-mark extraction
3. It routes each document to one of several custom models under one model ID
4. It converts every custom template model in the project into a neural model

Answer: C — It routes each document to one of several custom models under one model ID

C) Right — composition groups several trained custom models behind a single model ID and picks the matching one per document. A) Composition is for custom models, not a receipt-only restriction. B) Layout remains available and is unaffected. D) Composition does not retrain or change a model's type.

An archive of recorded webinars must be searchable by spoken topic and by text shown on the slides in the video frames. Which approach is MOST appropriate?

1. Speech to text only, since narrators normally read the slide text aloud verbatim
2. A prebuilt layout model run against periodically sampled frames from each video
3. Document Intelligence applied to exported slide decks, ignoring the recordings
4. A Content Understanding analyzer for video, capturing both spoken and on-screen content

Answer: D — A Content Understanding analyzer for video, capturing both spoken and on-screen content

D) Correct — video is a supported modality and a single analyzer can surface both the spoken track and text visible in frames, which is what the two search requirements need. A) tempts and covers half the requirement, but relies on an assumption that fails for charts and labels. B) is a plausible hand-built workaround that adds frame-sampling machinery and still misses the audio. C) captures the slides but loses everything said.

Which situation LEAST justifies choosing a pro-mode pipeline over a single-task analyzer?

1. Extracting five fixed fields from one standalone document per request
2. Cross-checking a submitted form against an attached supporting document
3. Grounding an extraction against a supplied reference data set
4. Producing one consolidated result from several related input files

Answer: A — Extracting five fixed fields from one standalone document per request

A) Correct — a single input with a fixed field list is the canonical single-task case, and pro mode would add cost and latency for no benefit. B) needs comparison across two inputs, which is a pro-mode strength. C) is exactly what reference data support in pro mode is for. D) requires consolidating multiple inputs into one result, again a pro-mode scenario.

Azure Language in Foundry Tools — features?

Sentiment analysis and opinion mining. • Key phrase extraction. • Named entity recognition and entity linking. • PII detection and redaction. • Language detection. • Extractive and abstractive summarization.

How does video generation differ operationally from image generation?

Video generation is a long-running asynchronous job: you submit a prompt with duration and resolution, poll an operation for status, then retrieve the asset. Costs and latency scale with length and resolution, and prompts must describe motion and camera behaviour, not just a static scene.

Protected Material detection?

Identifies generated content that matches known song lyrics, news, code from training data.

A model gives correct clinical answers that a default filter blocks. What is the appropriate response?

Request an approved modified content filter configuration for that deployment, raising the threshold only on the specific category and only for that legitimate use case, and pair it with logging and human review. Disabling safety wholesale, or stripping words to slip past the filter, is the tempting wrong path.

Why does chunking strategy matter for a vector index?

One embedding must represent one coherent idea. Chunks that are too large blur meaning and return diluted matches; chunks that are too small lose the context needed to answer. Overlapping chunks that respect document structure, with parent document and section retained as metadata, keep both retrieval precision and citation quality.

Image generation with Azure OpenAI in Foundry Models?

Generates images from a text prompt through the image generation endpoint. • Supports editing an existing image with a mask, known as inpainting. • Output carries provenance metadata and is subject to content safety checks.