You are planning a Microsoft Foundry project named Project1 that will contain multiple agents. Each agent will access the same Azure AI Search resource.
You need to recommend a solution to centrally manage the Azure AI Search credentials within Project1. The solution must be implemented across all the agents.
What should you recommend?
A.Enable role-based access control (RBAC) for the Azure AI Search resource.
B.Disable key-based access control on the Azure AI Search resource.
C.Add a connection to the Azure AI Search resource.Correct
D.Create a managed private endpoint that connects to the Azure AI Search resource.
Explanation
A project connection authenticates the project to an external resource such as Azure AI Search, and Foundry stores the connection details in a managed key vault, so every agent in the project can use one centrally managed definition. Enabling RBAC or disabling keys changes how the search service accepts authentication but gives the project no central place to manage access. A managed private endpoint only addresses network isolation, not credentials.
Your company is piloting a customer support agent in a Microsoft Foundry project named Project1. Project1 is connected to an existing Application Insights resource, and the company's support team reviews runs in the Traces tab.
The Foundry Agent Service is configured to perform the following actions:
- Retrieve the Application Insights connection string by calling project_client.telemetry.get_application_insights_connection_string().
- Call configure_azure_monitor(connection_string=...) to enable telemetry.
A separate LangChain service is configured to use OpenTelemetry and has the following configurations:
- Uses AzureAIOpenTelemetryTracer(connection_string=..., enable_content_recording=False)
- Passes the tracer by using config={"callbacks":[azure_tracer]}
Company policy has the following requirements:
- Telemetry from LangChain and OpenTelemetry must be distinguishable within the same Application Insights resource.
- Secrets and credentials must NOT be stored in prompts, tool arguments, or span attributes.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Explanation
Statement 1 (No): LangChain emits no Foundry traces on its own. You must instrument it, for example by creating AzureAIOpenTelemetryTracer and attaching it through callbacks, and without that instrumentation its spans do not appear.
Statement 2 (Yes): OTEL_SERVICE_NAME sets the OpenTelemetry service name, which is stored as a resource attribute on the telemetry. Giving each service its own value lets you tell them apart while they share one Application Insights resource.
Statement 3 (No): Setting enable_content_recording=False redacts message content and tool call arguments from the traces. Content recording is on by default, so this setting is what stops prompts and tool data from being captured.
You have a Microsoft Foundry project that processes procurement documents submitted by suppliers.
You need to implement two pipelines by using Azure Content Understanding in Foundry Tools. The solution must meet the following requirements:
- Include a pipeline named Pipeline1 that supports cost-effective, high-volume processing of standalone PDF invoices.
- Include a pipeline named Pipeline2 that supports cross-document validation by using multi-step reasoning and reference data.
How should you configure each pipeline? To answer, drag the appropriate configurations to the correct pipelines. Each configuration may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
Pipeline1 handles standalone invoices at high volume and low cost, so each file is its own task and standard mode provides straightforward field extraction without the extra reasoning cost. Pipeline2 must validate across documents by using reference data and multi-step reasoning, which calls for pro mode with multiple input files. Standard mode does not provide that reasoning, and pro mode on single files adds cost that Pipeline1 does not need and cannot compare documents for Pipeline2.
You have a Python application named App1 that integrates with a Microsoft Foundry project named Project1.
You need to ensure that App1 meets the following requirements:
- Authenticates by using a Microsoft Entra managed identity
- Sends prompts to a deployed model by using the Azure OpenAI Responses API
How should you complete the Python code? To answer, select the appropriate options in the answer area.
```python
from azure.identity import DefaultAzureCredential
from azure.ai.projects import AIProjectClient
credential = [Dropdown 1]()
project_client = AIProjectClient(
endpoint="https://contosoai.services.ai.azure.com/api/projects/project1",
credential=credential,
)
with project_client.get_openai_client() as openai_client:
response = openai_client.responses.[Dropdown 2](
model="trail-guide-chat",
input="Create a 3-day hiking itinerary near Seattle.",
)
print(response.output_text)
```
NOTE: Each correct selection is worth one point.
Explanation
Dropdown 1: DefaultAzureCredential resolves Microsoft Entra credentials in order and supports managed identity, so App1 authenticates without any stored secret. AzureKeyCredential uses an API key rather than Entra ID, and ClientSecretCredential authenticates a service principal with a client secret rather than a managed identity.
Dropdown 2: responses.create sends the model and input to generate a new response, and its result provides output_text. The retrieve method fetches an existing response by its ID, and compact reduces the context of an existing conversation, so neither sends this prompt.
You have a Microsoft Foundry project that contains a workflow for a customer support triage process.
You have an Ask a question node that stores user responses in a local variable named Var01.
You need to create the following Power Fx expressions:
- An if/else condition expression that ensures that Var01 contains a value
- A Send message expression that returns the stored user response in uppercase
How should you configure the expressions? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
If/else condition expression: Not(IsBlank(Local.Var01)) is true only when the variable holds a value. IsBlank(Local.Var01) is the opposite test, true when the variable has no value. IsEmpty checks whether a table has no records, so it is not the right test for a single response value.
Send message expression: {Upper(Local.Var01)} converts the stored response to uppercase, and the curly braces evaluate the formula inside the message. Local variables must carry the Local. prefix, so {Upper(Var01)} fails with a name error. {Local.Var01} returns the response unchanged, without the uppercase conversion.
You have a Microsoft Foundry project that contains a customer support agent built by using the Foundry Agent Service.
The agent uploads user-provided screenshots to Azure Storage through a ticketing tool and receives a blob URL for additional reasoning.
You need to use image moderation during agent runs and prevent harmful content from being returned during runs. Azure AI Content Safety must access the images by using the blob URL. The solution must follow the principle of least privilege.
What should you configure for Content Safety? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Guardrails: Selecting User input, Output, Tool response, and Tool call with Action set to Block scans every point where content enters or leaves the agent run and actually stops harmful content. Annotate only flags content without preventing it, and it is not available as an action for agents. Selecting only Tool call misses the screenshot content returned from tools and the final output.
Storage access: For a blob URL, Content Safety reads the image by using its system-assigned managed identity, and the documentation states that only Storage Blob Data Contributor or Storage Blob Data Owner are valid roles. Storage Blob Data Contributor is therefore the least privilege that works, even though Storage Blob Data Reader looks more restrictive. Access keys grant full account access, and a queue role does not grant access to blobs.
You have a Microsoft Foundry project that contains three agents as shown in the following table.
| Name | Description |
| --- | --- |
| TriageAgent | Classifies incoming customer requests |
| PolicyAgent | Answers policy questions by searching internal content |
| ActionAgent | Creates or updates tickets by calling an HTTP API |
You need to orchestrate the agents to ensure that the customer requests meet the following requirements:
- Support a deterministic, step-based process that uses conditional branching and shared state across the agents.
- Optionally trigger a ticket action based on the triage result.
The solution must minimize development effort.
What should you include in the solution?
A.a workflowCorrect
B.threads and runs without a workflow
C.a multi-agent group chat session
D.separate agent runs coordinated in the application code
Explanation
A workflow is a declarative, predefined sequence of actions that orchestrates agents in a repeatable process, with if/else branching and variables that carry state between steps, all without writing orchestration code. Threads and runs on their own provide no branching or shared process state. A group chat passes control between agents dynamically, so it is not deterministic. Coordinating separate runs in application code could work, but it requires the most development effort.
You have a Microsoft Foundry project that contains an agent. The agent uses Azure Speech in Foundry Tools.
You fine-tune a baseline speech to text model for the en-us locale and publish the model.
The agent calls the Speech to text REST API and returns an error message indicating that the project ID is invalid.
You need to set the project property to the correct ID.
To what should you set the project property?
A.the project URL
B.the custom speech project IDCorrect
C.the project ID
D.the custom speech endpoint URL
Explanation
When you use the Speech to text REST API for custom speech, the project property must be the ID of the custom speech project. That ID is not the same as the Microsoft Foundry project ID, which is why using the Foundry project ID fails. You can find the correct value in the browser URL after you open the custom model under AI Service fine-tuning. URLs for the project or the endpoint are not IDs, so they are not valid values.
You have a Microsoft Foundry project that contains an agent named PaymentAgent.
PaymentAgent includes a function tool that issues customer refunds by using an external API.
You are creating a workflow in YAML.
You need to ensure that the workflow pauses for human approval and continues with the refund step only after approval is granted.
How should you complete the workflow definition? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
```yaml
steps:
- id: propose_refund
type: agent
agent: PaymentAgent
- id: approval
type: [Dropdown 1]
- id: execute_refund
type: agent
agent: PaymentAgent
condition: [Dropdown 2]
```
Explanation
Dropdown 1: ask_question is the step that asks the user a question and waits for the input before the workflow proceeds, which is the human-in-the-loop pattern used for approval requests. A data transformation step only sets a variable or parses a value, and a basic chat step is not the question-and-wait step named for this purpose. Dropdown 2: approval == "approved" runs the refund only when the approval step returned approved. The value true would run the refund regardless of the answer, and propose_refund.output != null only checks that a proposal exists, not that anyone approved it.
You have an Azure Speech in Foundry Tools resource that hosts a custom speech to text model deployed to a custom endpoint. An agent uses the endpoint to perform real-time speech recognition.
You are approaching the expiration date of the custom speech to text model.
What is the expected behavior when the model expires?
A.Speech recognition requests will return a 4xx error until a new custom model is deployed.
B.Speech recognition requests will continue to use the expired custom model until the model is removed manually.
C.Speech recognition requests will fall back to the most recent base model for the same locale.Correct
D.The custom model will be deleted automatically when the model expires.
Explanation
On a custom endpoint, requests to an expired model fall back to the most recent base model for the same locale. You still get results, but recognition might not transcribe your domain terms accurately until you update the endpoint's model. The 4xx error applies to batch transcription requests that name an expired model, not to custom endpoints. An expired model is no longer available for transcription, so it cannot keep serving requests, and expiry is not described as deleting the model.
You have a Microsoft Foundry project that contains a model deployment.
You have an application that calls the deployment by using the Azure OpenAI v1 API and DefaultAzureCredential.
The developers at your company receive HTTP 403 errors when they send inference requests, even after running az login.
You need to ensure that the developers can perform model inference. The solution must follow the principle of least privilege.
Which role-based access control (RBAC) role should you assign to the developers?
A.Cognitive Services User
B.Cognitive Services OpenAI UserCorrect
C.Contributor
D.Cognitive Services Data Reader
Explanation
Signing in with az login only proves identity; the 403 means the identity lacks the data-plane permission to call the model. Cognitive Services OpenAI User allows inference API calls with Microsoft Entra ID without allowing changes to deployments or access to keys, so it meets least privilege. Contributor manages resources and does not grant inference data actions. Cognitive Services User is broader because it is not limited to Azure OpenAI, and Cognitive Services Data Reader is for reading data rather than running inference.
You have a Microsoft Foundry project that contains an agent. The agent has a Model Context Protocol (MCP) tool that queries a knowledge base stored in Azure AI Search.
Some agent runs return answers from the base model without invoking the knowledge base, which results in responses without grounded citations.
You are provided with the following code snippet that runs the agent.
You need to add the correct tool_choice parameter to the code to deterministically force the agent to invoke the MCP tool on each run.
What should you add?
A.tool_choice={"required"}Correct
B.tool_choice={"auto"}
C.tool_choice={"type":"knowledge_base"}
D.tool_choice={"type":"mcp"}
Explanation
Setting tool_choice to required gives deterministic behaviour because the model must call a tool, and the agent's knowledge base MCP tool is therefore used when processing the query. The value auto is the behaviour causing the problem, since it lets the model decide whether to call a tool. A knowledge_base type is not a tool_choice value for this scenario. The documented way to make an agent always use the knowledge base MCP tool is required, not a type setting of mcp.
You have a Microsoft Foundry project that contains a customer support agent grounded in internal documentation.
After a recent update, users report the following issues:
- Some answers are unsupported by retrieved documents.
- A small number of responses are flagged for policy violations.
You need to evaluate each issue.
Which observability signals should you use for each issue? To answer, drag the appropriate observability signals to the correct issues. Each observability signal may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
Groundedness is a RAG-specific quality metric that measures whether a response is supported by the retrieved content, so it fits answers that the documents do not back up. Risk and safety metrics measure safety and security concerns such as harmful or protected content, so they fit responses flagged for policy violations. Latency traces show where time is spent and token analytics show consumption, and neither measures whether an answer is supported or compliant.
You have a Microsoft Foundry project named Project1 that contains an agent. The agent uses an OpenAPI 3.0 specification to call an external weather service.
The weather service requires a key to be passed in an HTTP header. The key value is stored as a connection in Project1.
You need to ensure that the key value from the connection is included automatically whenever the OpenAPI tool is invoked.
What should you configure in the OpenAPI specification?
A.a header parameter defined for each operation
B.an Azure Key Vault connection
C.an API key security schemeCorrect
D.a Bearer token security scheme
Explanation
The OpenAPI tool passes a stored key when the specification has a securitySchemes entry of type apiKey, with the header name matching the key name in the project connection, plus a security section that references it. Without this configuration, the key isn't included in requests. Per-operation header parameters are the wrong approach, because the documentation says to remove any parameter that needs the key since it is passed through the connection. A Key Vault connection is not an OpenAPI specification setting, and a Bearer scheme does not describe a key sent in a named header.
You have a Microsoft Foundry project that serves a high-volume chat app.
Most requests are simple FAQs, but some require advanced reasoning.
You need to reduce costs and latency for common queries, without degrading the quality of the responses to complex questions.
What should you do?
A.Route all the requests to a smaller model.
B.Use a model cascade that routes the requests to different models.Correct
C.Increase the value of the max_tokens parameter for all the requests.
D.Route all the requests to the most capable model.
Explanation
Routing each request to a model that fits its complexity sends simple FAQs to smaller, cheaper, faster models and keeps larger or reasoning models for the requests that need them, which is the pattern Foundry's model router implements. Sending everything to a smaller model would degrade the complex answers, and sending everything to the most capable model would keep costs and latency high for the common queries. Increasing max_tokens only allows longer outputs and does nothing to lower cost or latency.
You have a Microsoft Foundry project that contains an internal Q&A agent.
Users report the following issues when they ask the agent questions:
- An increase in the following response: "No relevant information found"
- Periodic HTTP 429 rate limit exceeded errors during peak hours
You need to identify whether each issue is caused by model unavailability, resource limits, or inference failures.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Metrics to enable: Model Availability Rate and Provisioned Utilization separate the first two causes. Model Availability Rate is calculated from server errors (HTTP 500 and above), so it reveals model unavailability, and Provisioned Utilization shows when consumption reaches 100%, the point at which calls are throttled with error 429, so it reveals resource limits. Cache match rate, requests filtered to status 200, and latency with token totals cannot distinguish these causes, and filtering to status 200 would hide the failures altogether.
Diagnostic log to collect: RequestResponse records the individual requests and their outcomes, which lets you investigate inference failures call by call, including calls that succeed at the HTTP level but return an unhelpful answer. AllMetrics is a metrics export rather than a request log, and audit and trace do not record the per-request results needed here.
You have a Microsoft Foundry project that contains a high-traffic agent.
After a recent update, operational costs increase significantly.
Monitoring confirms that the volume of user traffic to the agent remains unchanged.
You suspect that changes to the request or response characteristics are causing the increase. You need to identify whether the additional costs are driven by the model input size, the model output size, or expanded tool usage.
Which observability capability should you use?
A.latency
B.evaluation metrics
C.run success rate
D.token usageCorrect
Explanation
Token usage reports input tokens and output tokens separately, so it shows directly whether requests or responses have grown, and tool definitions also count toward prompt tokens, so added tools appear there as well. Latency measures response time, not what is being consumed. Evaluation metrics measure response quality, and run success rate only shows whether runs complete, so neither explains a change in cost.
You have a Microsoft Foundry project that contains an agent.
The agent uses tools to retrieve internal content and call external APIs. The agent is configured to let the model decide when to call the tools.
You need to publish the agent for a compliance workflow. The solution must meet the following requirements:
- Each workflow run must include a retrieval step before generating a response.
- Tool calls must authenticate by using the published agent's own identity.
- Tool access must use an identity isolated from other project resources.
- Tool access must use support audit tracing.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Set tool_choice to: required makes the model call a tool, which guarantees the retrieval step in every run. The current setting, auto, lets the model decide and so can skip retrieval, and none prevents tool calls altogether.
Configure the tool to authenticate by: a distinct agent identity gives the published agent its own identity in Microsoft Entra ID, so its permissions and activity can be scoped and audited separately from other project resources. The shared project agent identity is used by every legacy agent in the project and has no identity-level separation, and storing API keys in prompts exposes secrets and provides no agent identity at all.
You have a Microsoft Foundry project named Project1 that contains the following:
- An OpenAPI tool that calls an external API
- A project connection named Connection1 that stores the API key of the external API
When an agent calls the OpenAPI tool, the API returns a 401 unauthorized error, and traces show that the API key header is NOT being sent.
You need to ensure that the OpenAPI tool automatically includes the API key from Connection1 on all requests.
What should you do?
A.Enable identity passthrough so that the tool uses the Microsoft Entra token of the caller.
B.Add the API key header manually to the OpenAPI specification.
C.Configure the tool to use the default connection of Project1.
D.Connect the tool to Connection1.Correct
Explanation
An OpenAPI tool gets its API key from a project connection, and the tool must reference that specific connection by its resource ID for the key to be added to requests. Identity passthrough sends a Microsoft Entra token, not the API key the external API expects. Adding the key header manually to the specification is wrong because the specification only declares the scheme, and any parameter carrying the key should be removed so the connection supplies it. A project default connection is not how the tool finds the key: it uses the connection it is explicitly linked to.
You have a Microsoft Foundry project that contains a customer support agent. The agent calls an internal knowledge API tool before generating responses.
Users report the following issues:
- Some requests take more than 15 seconds to complete.
- Some responses are incorrect, even when the knowledge API returns the expected data.
You need to inspect individual agent runs to view the ordered sequence of large language model (LLM) calls, tool invocations, and timing information.
Which observability capability should you use?
A.token usage
B.monitoring
C.safety metrics
D.tracingCorrect
Explanation
Tracing records each step of an individual agent run in the order it was invoked, with the inputs, outputs, tool calls and timing of every span, so you can see where the delay or the wrong answer was introduced. Token usage shows consumption, not the sequence of steps. Monitoring gives aggregate metrics over time rather than a view of a single run, and safety metrics report on harmful content.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.
