Free Practice Questions for Microsoft AI-500 Exam

Intervention point: Tool response; Risk: Indirect attacks.

The hidden instructions originate in retrieved HTML returned by supported tools, not in the user ' s direct prompt. Microsoft classifies that pattern as an indirect prompt-injection attack. The Tool response intervention point is specifically designed to inspect the complete payload returned from a tool before the content is stored in agent memory or used for subsequent reasoning. Configuring the Indirect attack control there with a blocking action prevents tainted retrieved data from steering the triage agent. Azure AI Search and Azure Functions are among the supported tools for tool-response moderation, which is important because both appear in the scenario. A Tool call control would inspect arguments sent to a tool rather than hostile content coming back from it. User-input attack detection likewise targets the wrong origin. The correct configuration is therefore Tool response plus Indirect attacks, with the operational response set to stop processing and alert the security workflow when malicious content is detected.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points

============================================================

Only one agent should be active at a time, and the active agent must be able to transfer control dynamically when another specialist is better suited. Microsoft Agent Framework defines handoff orchestration for precisely that situation: task and conversational ownership move from one agent to another according to context. Concurrent orchestration would activate multiple specialists at the same time, contradicting the requirement. Sequential orchestration follows a predetermined order rather than allowing contextual transfer. Group chat keeps multiple agents participating in a shared conversation rather than modeling single-owner control. The decisive requirement is therefore transfer of ownership, not merely calling another agent for a subtask. That makes B, handoff, the correct orchestration pattern. In production, add telemetry and regression tests around this behavior so changes to prompts, models, tools, or orchestration do not silently alter the intended contract. The selected approach is the one that best matches the platform ' s native execution semantics.

Official Microsoft reference: Microsoft Agent Framework - Handoff orchestration

============================================================

Runtime instrumentation: OpenTelemetry distributed tracing with correlation IDs; Post-deployment assessment: A scheduled evaluation that uses test datasets.

Distributed tracing is the correct runtime mechanism because the objective is to reconstruct a user interaction across agents, models, tools, functions, and API boundaries without relying on verbose log text. Microsoft Foundry uses OpenTelemetry-compatible traces and Application Insights so related spans can be correlated into one execution path. Correlation identifiers allow operators to isolate one conversation and inspect where latency, failures, or unexpected behavior originated. The second requirement is different: it asks for recurring, comparable measurements of deployed response quality and safety. Scheduled evaluations against stable test datasets provide that longitudinal benchmark and are more appropriate than ad hoc tracing or infrastructure-only dashboards. Together, OpenTelemetry answers “what happened in this run?” while scheduled evaluation answers “is behavior getting better or worse over time?” The selected pair therefore covers both operational diagnosis and quality regression monitoring. For operational use, the measurement should be captured in a repeatable dataset, trace, or automated gate so that the same criterion can be compared across versions. That is more useful than a one-off manual observation and makes regressions visible before they become production incidents.

Official Microsoft reference: Microsoft Foundry observability concepts

============================================================

Semantic cache metric: Candidate-set recall and precision; Integrated system check: An end-to-end evaluation against the curated dataset; Regression dataset: Add cases for the new capability to the curated dataset.

The semantic cache is acting as a retrieval/shortlisting component, so recall and precision are the appropriate measures of whether expected agent candidates are surfaced and whether irrelevant candidates are avoided. The pull request also changes the selector prompt and adds an agent, so component-only tests are insufficient; an end-to-end evaluation must exercise retrieval, routing, the new agent, and final response generation together. Finally, the version-controlled regression dataset should evolve with the capability. Adding representative cases for the new agent keeps expected routing and responses aligned with the code and prompt changes in the pull request. Microsoft Foundry evaluation guidance treats curated datasets as reusable regression assets for CI/CD quality gates. Together, these three selections test retrieval quality, integrated behavior, and regression coverage at the correct layers. The evaluation should also preserve correlation identifiers and version information where possible so a failed score can be traced back to the exact agent, model, tool call, or retrieval step that produced it. This turns the metric into an actionable diagnostic rather than only a dashboard number.

Official Microsoft reference: Microsoft Foundry - evaluation datasets and CI/CD evaluation

============================================================

No / No / Yes

The ADO MCP configuration does not satisfy the stated production gate because it lacks the required allowed-tool restriction and disables approval; its discovered schema also conflicts with the gate ' s schema restrictions. The GitHub configuration likewise cannot be considered schema-compliant based on the shown metadata. The third statement, however, is true: Microsoft Foundry MCP tool configuration supports an `allowed_tools` allowlist that limits which discovered MCP tools are exposed to the agent. Adding ` " allowed_tools " : [ " get_profile " ]` therefore restricts the GitHub MCP integration to that tool, assuming the name matches the discovered tool exactly. This control is materially stronger tha n relying on prompt instructions because excluded tools are not presented as available choices. The corrected sequence is No, No, Yes. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Foundry agents - Model Context Protocol tools

============================================================

The restriction belongs in the agent ' s MCP tool configuration because Microsoft Foundry supports an `allowed_tools` allowlist that controls which tools discovered from an MCP server are exposed to the agent. Configuring the allowlist to include only `docs_search` makes `deployment_delete` unavailable for model selection. This is stronger than adding a sentence to the agent instructions because instructions influence behavior but do not remove a dangerous tool from the callable surface. Project details describe resources rather than per-agent tool exposure, and a transient run setting is not the appropriate persistent configuration boundary for the registered MCP integration. Therefore C, the agent tool configuration, is the correct answer. Least privilege remains the governing principle: grant only the identity, data, tool, or deployment access required for the specific operation. The selected answer preserves that boundary while still allowing the workflow to satisfy its functional requirement. From a security and governance perspective, the control should be enforced at the narrowest platform boundary that can deterministically block or constrain the action. Relying only on prompt text is weaker because the model can still be induced to behave unexpectedly.

Official Microsoft reference: Microsoft Foundry agents - Model Context Protocol tools

============================================================

The business requirement says that a physician must approve any triage assessment that recommends an emergency room visit. The workflow must therefore pause and collect a human response before continuing. Ask a question is the option that introduces that interactive human-in-the-loop step. Deliver a message only informs someone; it does not capture a decision. Agent invokes another AI component, which would not satisfy the explicit requirement for a physician ' s approval. Go to changes the workflow path but likewise does not obtain human authorization. Microsoft Agent Framework documents human-in-the-loop request/response patterns for cases where execution must wait for approval or additional human input. For a medical escalation decision, the control must be deterministic and auditable rather than encoded as a prompt suggestion. Consequently, Ask a question is the workflow node that best enforces the business requirement. At implementation time, the same rule should be expressed through the framework or service configuration rather than left only as a natural-language convention. That makes the behavior repeatable across runs, easier to test, and less sensitive to model variability.

Official Microsoft reference: Microsoft Agent Framework - Human-in-the-loop workflows

============================================================

The malicious text is contained in an uploaded email rather than being typed directly as the user ' s prompt. Microsoft classifies malicious instructions embedded in external or retrieved content as an indirect prompt-injection attack. Prompt Shields for documents is designed to detect those attacks in document content before the content can steer the model away from its system instructions. Prompt Shields for user prompts addresses direct attacks originating in the user ' s prompt and therefore targets the wrong attack surface here. Groundedness evaluates whether a response is supported by context; it does not prevent an injected instruction from changing agent behavior. Task Adherence can assess whether an agent follows its task constraints, but it is not the primary control for document-borne prompt injection. Because the source of the attack is the uploaded email, the document-oriented Prompt Shields control is the technically aligned guardrail. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points and indirect attacks

============================================================

Log the start/completion of each specialist run and inspect the final output with Agent run middleware; record each customer-refund-tool call, including function name and arguments, with Function calling middleware.

The two logging requirements occur at different lifecycle boundaries. Agent run middleware surrounds an agent invocation, so it is the appropriate place to capture run start, run completion, exceptions, and the final agent result. Function calling middleware surrounds tool/function execution and can inspect the selected function, arguments, result, and failures. That makes it the correct boundary for an audit record of each customer-refund-tool invocation. Foundry tracing can provide broader distributed observability, but the question asks for reusable Microsoft Agent Framework middleware at the exact execution points. A knowledge store or memory store does not provide execution interception. Separating the two concerns also supports a cleaner audit model: agent-level middleware records specialist behavior, while function-level middleware records tool use. This aligns with Microsoft ' s middleware model, where cross-cutting concerns such as logging, validation, and exception handling can be implemented once and applied consistently rather than duplicated inside every agent or tool.

Official Microsoft reference: Microsoft Agent Framework - Defining middleware

============================================================