Free Microsoft AI-500 Practice Exam with Questions & Answers

The instructions changed in the playground, but a full evaluation needs a stable, versioned agent definition. Saving the changes as a new version creates an immutable snapshot that can be evaluated against a synthetic dataset while remaining inside the project for the development team. Publishing is a later lifecycle action that makes a version available to broader consumers or production endpoints and is not required for a private development evaluation. Previewing exercises the current playground configuration interactively but does not establish the versioned target needed for repeatable evaluation. Creating an evaluation before saving the new version risks evaluating the previous configuration instead of the intended update. Microsoft Foundry ' s development lifecycle separates edit, save/version, evaluate, and publish stages, so A is the correct first action. A robust evaluation program separates process metrics from final-response metrics. The selected answer measures the layer where the stated failure actually occurs, which is essential for deciding whether to change retrieval, orchestration, prompt behavior, or the final generator.

Official Microsoft reference: Microsoft Foundry agents - development lifecycle

============================================================

Both stated restrictions concern content that must not appear in the agent ' s final output. A custom blocklist should therefore be applied to agent output so the two sanctioned company names are detected before a response is returned. The customer-account requirement likewise belongs at the output boundary, where PII/sensitive-data detection can identify protected identifiers in generated content. Applying the controls only to user input would not stop the model from generating the prohibited names or identifiers itself. Task Adherence focuses on whether agent behavior stays within assigned procedures and is not a substitute for explicit output filtering. Microsoft Foundry guardrails are designed to attach controls to the intervention point where the relevant risk occurs. Because the risk is disclosure in the response, option C is the configuration that places both controls at the correct boundary. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points

============================================================

The proposed solution uses delegated user permissions for agent actions and assigns Azure roles through one shared security group. Even if it avoids storing an application secret, it does not create strong per-agent authorization boundaries. Sharing downstream permissions through one group can allow a compromised agent to inherit access intended for other agents, which conflicts with the requirement to limit blast radius. Microsoft Foundry identity guidance recommends distinct logical agent/workload identities and narrowly scoped role assignments when agents have different resource responsibilities or audit requirements. Delegated user access is appropriate when an operation genuinely needs the signed-in user ' s authorization context, not as a general service-to-service isolation model for autonomous A2A workers. Therefore the proposed design does not meet both goals, and B, No, remains correct. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Foundry agent identity

============================================================

When multiple projects share one Foundry resource, grouping costs only by Azure resource cannot distinguish project consumption because the resource boundary is shared. Microsoft Foundry integrates with Azure Cost Management by attributing model usage to project metadata/tags, allowing a Cost Analysis view to filter shared resource spending by project. This supports showback or chargeback without requiring administrators to manually tag every usage event. Subscription-level service filters or meter grouping identify the service or billing meter but not which of the three business-unit projects generated the usage. Therefore a Foundry-resource-scoped Cost Analysis view filtered by the project tag is the configuration that both reconciles to Azure Cost Management and minimizes manual tagging. D remains correct. The evaluation should also preserve correlation identifiers and version information where possible so a failed score can be traced back to the exact agent, model, tool call, or retrieval step that produced it. This turns the metric into an actionable diagnostic rather than only a dashboard number.

Official Microsoft reference: Microsoft Foundry - Manage costs

============================================================

GitHub issues are the authoritative source for current requirements, and those requirements can change while a long-running workflow is still executing. Each handoff should therefore reconstruct context from the current issue state and discard memory that has been invalidated by newer requirements. Keeping an accumulated summary allows obsolete criteria to remain present and also causes the prompt to grow until older content is truncated. Persisting the transcript in Cosmos DB preserves history but does not make that history current. Giving subagents a GitHub lookup tool while continuing to inject the stale summary can expose the model to conflicting versions of the same requirement. Microsoft Agent Framework context providers are intended to inject current external context at invocation time, making C the approach that simultaneously preserves freshness and bounds context growth. In production, add telemetry and regression tests around this behavior so changes to prompts, models, tools, or orchestration do not silently alter the intended contract. The selected approach is the one that best matches the platform ' s native execution semantics.

Official Microsoft reference: Microsoft Agent Framework - Context providers

============================================================

The three risks occur at three different intervention points. Direct jailbreak attempts originate in the user prompt, so User input attacks should be evaluated at the User input boundary and blocked. Malicious instructions embedded in retrieved documents are indirect prompt-injection attacks and belong at the Tool response boundary before the retrieved content can influence downstream reasoning. Protected material in the final response must be flagged for legal review, not necessarily blocked, so an Output control using annotate-only behavior matches the requirement. Options A and B misplace at least one control or block content that the scenario says should only be flagged. Microsoft Foundry guardrails are explicitly designed around these intervention points, making C the configuration that aligns each risk with the stage where it can be detected and acted upon. From a security and governance perspective, the control should be enforced at the narrowest platform boundary that can deterministically block or constrain the action. Relying only on prompt text is weaker because the model can still be induced to behave unexpectedly.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points

============================================================

Memory evaluation must verify persistence across interruption, correctness of checkpointed state, and enough telemetry to locate where continuity was lost. Running a scripted multi-turn case with one stable `thread_id` before and after a restart directly tests whether the Cosmos-backed LangGraph checkpointer restores the same conversation/workflow. Comparing persisted checkpoint documents with expected state values at each handoff verifies that claim-related state has not been corrupted by the new pruning rules. Correlating the evaluation run with trace spans then provides the diagnostic path to identify which agent transition or state-management operation caused a failure. Changing the thread ID each turn would intentionally create separate state scopes, and removing durable artifacts would defeat the persistence test. Tool-call arguments alone do not prove workflow-memory continuity. Therefore D, E, and F are the complementary actions required. The evaluation should also preserve correlation identifiers and version information where possible so a failed score can be traced back to the exact agent, model, tool call, or retrieval step that produced it. This turns the metric into an actionable diagnostic rather than only a dashboard number.

Official Microsoft reference: Azure Cosmos DB integrations for LangGraph and agent state

============================================================

The business rule requires human review for refunds above the stated threshold before payment can continue. A workflow therefore needs a user or operator interaction point that pauses progress and obtains an explicit response. In the workflow options provided, Ask a question is the node that introduces that human interaction. Invoke agent simply delegates work to another agent; it does not itself guarantee human approval. Deliver a message sends information without collecting a decision, and Go to changes control flow without obtaining authorization. Microsoft Agent Framework and Foundry workflow guidance treat human-in-the-loop approval as a first-class orchestration requirement for consequential actions. The decisive requirement is not just to notify a reviewer, but to stop automated progression until the reviewer supplies a decision. Therefore the workflow must include an interactive question/approval step before the refund-processing action can proceed for amounts over the threshold. The implementation should also preserve clear inputs and outputs around this step so that later agents receive only the information they require. This improves debuggability and keeps token, permission, and state growth under control as the workflow becomes more complex.

Official Microsoft reference: Microsoft Agent Framework - Human-in-the-loop workflows

============================================================

Prior claims: memory-store-490; Contact preferences: memory-store-490.

Both requirements describe information that should persist across conversations for the same customer: previous claim information and stable contact preferences. Microsoft Foundry Memory is intended for durable, cross-session facts and summaries that agents can retrieve later, while a knowledge base is for shared reference content rather than user-specific history. The refund-processing and customer-refund tools are operational interfaces, not persistence layers. Using the existing memory store for both categories therefore matches the scenario ' s design objective. In production, the memory search tool should also be scoped to the end user so one customer ' s memory cannot be retrieved for another customer. Microsoft documents scope-based isolation for memory stores and supports a user-derived scope such as `{{$userId}}`. The key distinction is that the same memory store can hold multiple kinds of durable customer memory as long as retrieval is correctly scoped; there is no need to create separate tools or knowledge indexes for these two user-specific memory categories.

Official Microsoft reference: Create and use memory in Foundry Agent Service

============================================================

Provision Test, Acceptance, and Production by using a Bicep file applied through the CI/CD pipeline in Azure Pipelines; block promotion when quality falls below the threshold by using Foundry Agent Evaluator as a pipeline release gate.

The release lifecycle must satisfy two independent requirements: repeatable infrastructure deployment across DTAP environments and an automated quality gate before promotion. Bicep is Azure ' s infrastructure-as-code language, and Microsoft documents deploying Bicep through Azure Pipelines so the same declarative resources can be promoted consistently across subscriptions. For the promotion decision, an automated Foundry evaluation is the appropriate control because response quality is an AI-system property that should be measured against a defined threshold before the next stage is released. A manual portal deployment would weaken repeatability, while a deployment-only gate would not measure model or agent behavior. The important design point is that infrastructure provisioning and AI quality validation are separate controls in the same pipeline: Bicep establishes environment parity, and the evaluation gate prevents a technically deployable but behaviorally degraded agent version from advancing. From a security and governance perspective, the control should be enforced at the narrowest platform boundary that can deterministically block or constrain the action. Relying only on prompt text is weaker because the model can still be induced to behave unexpectedly.

Official Microsoft reference: Deploy Bicep files with Azure Pipelines; AI-500 Study Guide

============================================================