Plan and Manage a Foundry Solution — Azure AI Apps and Agents Developer AI-103 practice questions

After a private endpoint is created for a Foundry Tools resource, applications inside the virtual network still connect over the public path. What is the MOST likely missing piece?

1. Private DNS is not resolving the resource's hostname to the private IP
2. The private endpoint requires a public IP to be assigned before it activates
3. The applications must be rewritten to call the private IP address directly
4. Service endpoints must be enabled on the subnet alongside the private endpoint

Answer: A — Private DNS is not resolving the resource's hostname to the private IP

A) Correct — clients keep using the service hostname, so unless a private DNS zone maps that hostname to the private IP, resolution returns the public address and traffic takes the public path. B) Private endpoints deliberately have no public IP. C) Hard-coding an IP would break TLS name validation and is never the intended fix; DNS is. D) Service endpoints are an alternative mechanism, not a prerequisite, and mixing them does not fix name resolution.

How should an Azure web app authenticate to Azure Language in Foundry Tools without storing keys?

1. Store the resource key in the app configuration file
2. Use a managed identity granted the Azure AI User role
3. Pass the resource key as a query string parameter
4. Call the endpoint anonymously over TLS with no credential

Answer: B — Use a managed identity granted the Azure AI User role

B) A managed identity obtains Microsoft Entra tokens at runtime, so no secret is stored or rotated by hand; the identity needs a data-plane role such as Azure AI User. A) A key in configuration still has to be protected and rotated. C) Query strings land in logs and traces, leaking the key. D) Foundry Tools endpoints always require a credential.

An application must call both a model deployment and an Azure Search in Foundry Tools index that are attached to the same Foundry project. The team wants to avoid hard-coding each service's address. What is the BEST approach?

1. Connect using the project endpoint and resolve resources via the project client
2. Store both service endpoints in the application's configuration file and read them at startup
3. Enumerate the subscription with the management API at runtime to discover the endpoints
4. Place both services behind a single custom domain and route by URL path

Answer: A — Connect using the project endpoint and resolve resources via the project client

A) Correct — the project endpoint plus the project's connections is exactly the indirection that lets an application reach attached resources without embedding each address. B) It works but reintroduces the hard-coding the team wanted to avoid, and it drifts when a connection changes. C) Management-plane enumeration is heavyweight, needs broad read rights and is not the intended discovery path. D) A reverse proxy hides addresses from the outside world but the application still hard-codes routes and gains an extra failure point.

A team will use vision, language and speech capabilities from one application and wants a single endpoint and one key to manage. Which resource choice is MOST appropriate?

1. A single-service resource for each capability, sharing one resource group
2. A separate subscription per capability to keep the endpoints distinct
3. One single-service resource, with the other capabilities called through it
4. A multi-service Foundry Tools resource covering the capabilities together

Answer: D — A multi-service Foundry Tools resource covering the capabilities together

D) Correct — a multi-service resource exists precisely to expose several capabilities behind one endpoint and one credential, simplifying configuration for an application that uses many of them. A) Single-service resources each carry their own endpoint and key, which is the management burden the team wants to avoid. C) Capabilities are not proxied through one another; each has its own API surface. B) Subscription-per-capability multiplies governance overhead and solves nothing here.

A generative application intermittently returns unhelpful answers, and the team must see which retrieval and tool steps ran for a given user request. Which capability addresses this MOST directly?

1. Platform metrics for request count and latency on the resource
2. Cost analysis broken down by each model deployment
3. A content filter report summarising the blocked categories
4. Tracing that records the spans of each step in the request

Answer: D — Tracing that records the spans of each step in the request

D) Correct — tracing captures the ordered spans for retrieval, tool calls and model invocations within one request, which is what per-request diagnosis requires. A) Aggregate counters show that something is slow or failing but never which step in a specific request misbehaved. C) Filter reports explain blocked content, a different failure mode from an unhelpful answer. B) Cost breakdowns attribute spend and say nothing about execution path.

How is customer-managed key encryption configured for a Foundry Tools resource?

1. It is not supported; only service-managed keys are offered
2. Reference a Key Vault key from the resource encryption blade
3. Turn encryption at rest off and encrypt in the application
4. Enforce TLS 1.2 on the endpoint so payloads are encrypted

Answer: B — Reference a Key Vault key from the resource encryption blade

B) The resource is pointed at a key in your key vault and its managed identity is granted wrap and unwrap rights, so you control rotation and revocation for data at rest. A) Customer-managed keys are supported alongside the default service-managed keys. C) Encryption at rest cannot be switched off. D) TLS protects data in transit, a separate control from encryption at rest.

A bank requires that its Foundry Tools resource be reachable only from an Azure virtual network and never from the public internet. Which configuration meets this requirement?

1. Restrict inbound traffic with a network security group on the subnet
2. Add the corporate egress addresses to the resource's IP firewall allow list only
3. Create a private endpoint for the resource and disable public network access
4. Place the resource in a dedicated subscription with a deny-all Azure Policy

Answer: C — Create a private endpoint for the resource and disable public network access

C) Correct — a private endpoint puts the service on a private IP inside the virtual network, and disabling public network access closes the public path, which is the pair the requirement demands. A) An NSG governs traffic within the network and cannot stop anyone else on the internet reaching a public endpoint. B) An IP allow list still uses the public endpoint and narrows rather than removes internet exposure. D) Policy governs what can be deployed, not what network path a deployed resource answers on.

The Face Identify and Verify operations in Azure Vision in Foundry Tools require:

1. Nothing beyond a resource key; any caller may use them
2. A free tier resource, because the operations are not billed
3. Limited Access approval with responsible AI attestations
4. A GPU-backed compute cluster deployed in the same region

Answer: C — Limited Access approval with responsible AI attestations

C) Identification, verification, liveness and several attribute features sit behind Limited Access, so you register the use case and attest to the responsible AI terms. A) A key alone does not unlock the gated operations. B) Tier and gating are unrelated. D) The service is fully managed, so you bring no compute.

A model deployment must be reachable only from the company's virtual network. What should be configured?

1. Rotate a longer API key weekly and store it in a secrets vault instead
2. Require a CAPTCHA challenge before the inference endpoint will respond
3. Configure private endpoints and disable public network access entirely
4. Allow only approved user-agent strings on requests reaching the service

Answer: C — Configure private endpoints and disable public network access entirely

C) Right — a private endpoint puts the service on the virtual network, and disabling public network access removes the internet-facing path. A) A stronger key still answers requests from anywhere. B) CAPTCHAs guard human web flows, not machine API traffic. D) User-agent headers are trivially forged and are not isolation.

An app uses the Azure Vision in Foundry Tools SDK but points at an Azure Document Intelligence in Foundry Tools endpoint. What happens?

1. It works, because both services share one regional endpoint
2. Accuracy improves because two models process each request
3. Errors or an unexpected response shape until the two align
4. Latency drops because the call skips vision preprocessing

Answer: C — Errors or an unexpected response shape until the two align

C) The SDK builds request paths and parses responses for its own service, so a mismatched endpoint fails or returns a shape the client cannot read; align the SDK with the endpoint. A) Each service has its own route even on a multi-service resource. B) Only one service ever answers. D) A mismatch cannot make the call faster.

Which signals should be monitored for a production model deployment?

Token consumption against quota, throttled request rate, latency and time-to-first-token, error classes, content-filter trigger rates, and evaluation scores sampled from live traffic. Traces tie an individual poor answer back to its prompt, retrieved context and tool calls.

Why deploy a Foundry Tools capability as a container, and what still connects to Azure?

Containers run the capability on local or edge hardware so the payload never leaves the site — useful for latency, disconnected operation and data residency. The container still requires billing configuration pointing at the Azure resource and reports usage back for metering.

Which certification exam replaced AI-102, and when did AI-102 retire?

AI-103, Developing AI Apps and Agents on Azure, replaced AI-102. AI-102 retired on 30 June 2026, so any study material written against it is out of date on both blueprint and product names.

What item formats should a candidate expect on AI-103, and which two formats are absent?

It is proctored and may include interactive components such as drag-and-drop, build-list and simulation items. There are no case studies and no full Azure sandbox lab.