AB-731 AI Transformation Leader Questions and Answers

Answer Area

Prompt engineering changes how a generative AI model was trained. Answer: No

Prompt engineering focuses on designing clear, concise, and context-rich instructions. Answer: Yes

Effective prompt engineering involves maximizing the number of tokens used in each request. Answer: No

No — Prompt engineering does not modify model weights or retrain the model. It is an inference-time technique : you steer outputs by improving the instructions and context you send to the model. Changing how a model was trained would involve pretraining, fine-tuning, or other training methods—separate from prompt engineering.

Yes — The primary goal of prompt engineering is to reduce ambiguity and variability by providing clear instructions , the right context , and explicit output constraints . This often includes specifying role and task, providing necessary facts or grounding text, defining format (bullets, JSON, headings), and adding examples (few-shot) when helpful. Well-constructed prompts improve consistency, relevance, and usefulness of outputs.

No — Good prompt engineering does not mean “use as many tokens as possible.” In fact, using unnecessary tokens can increase cost and may degrade quality by adding noise. Effective prompts are typically as short as possible but as long as necessary : enough context to achieve accuracy and alignment, but not bloated. Token discipline matters because most pricing is token-based and long contexts can dilute attention over what’s most important.

Microsoft 365 Copilot is designed to work within the Microsoft 365 ecosystem and use organizational context that is already governed by Microsoft Entra ID, Microsoft 365 permissions, and compliance controls. By default, Copilot can use Microsoft Graph signals and content that exist in Microsoft 365 workloads the user already has access to—most commonly emails, files, meetings, and chats . That corresponds to A .

The key concept is permission-trimming: Copilot doesn’t magically gain access to everything; it can only surface or use data that the signed-in user is permitted to access in Microsoft 365. This is what makes Copilot valuable for productivity scenarios—summarizing email threads, drafting replies, generating meeting recaps, creating documents from your files, or pulling context from Teams chats—because those artifacts are already part of daily work and already subject to tenant policies.

The other options are not “by default” Microsoft Graph content for Copilot: B (file shares) typically requires additional integration or migration into Microsoft 365 repositories or indexing via connectors; it’s not inherently available. C is unrelated to Microsoft 365 tenant work data. D (public web) is not “information in Microsoft Graph”; web grounding is a separate capability and not the default Graph workload data source referenced here.

The problem is harmful output language (inappropriate or exclusionary/ableist content). The requirement says you must prevent those responses while minimizing costs . The most cost-effective and direct control is to add a content-moderation filter (B) to screen and block (or rewrite/escalate) responses that violate your safety or inclusion standards. Moderation can be applied at the output stage (and often also at input) without retraining the model, which keeps costs and delivery time low. It also provides an immediate safety layer even if the underlying model occasionally produces biased or exclusionary phrasing.

Option A is not reliable: a newer model version might reduce issues but does not guarantee elimination of ableist language, and you still need policy enforcement. Option C (retraining on only inclusive content) can help, but it is typically expensive (data curation, re-training, re-evaluation, regression testing, re-deployment) and not the “minimize costs” path—also it can reduce coverage/utility if overly restrictive. Option D is clearly wrong because it would amplify the harmful behavior.

In practice, the lowest-cost, high-impact approach is to implement moderation thresholds and handling actions (block, warn, regenerate with constraints, human review) and then, if needed, follow up later with deeper mitigations like prompt constraints, targeted fine-tuning, red-teaming, and continuous evaluation.

Preventing generative AI from accessing confidential or classified information is primarily a data access and classification control problem. The most effective broad solution is data governance (B) —the framework of policies and controls that ensures sensitive content is identified, classified, protected, and access is restricted using least privilege. Data governance includes information classification/sensitivity labels, access control reviews, secure sharing practices, data loss prevention (DLP), and auditing—controls that directly limit what data is available to the AI through permission trimming and policy enforcement.

An information barrier (A) policy is more specific: it’s intended to prevent communication and collaboration between defined user groups (often for regulatory/ethical walls). It does not comprehensively address document classification or restrict AI access to sensitive files across the tenant. A data retention policy (C) governs how long content is kept and when it’s deleted; it’s not a primary access-prevention mechanism. Communication monitoring (D) is a detection/oversight control; it can help identify risky activity, but it does not itself prevent access to confidential content by the AI.

Therefore, to prevent AI from surfacing confidential/classified data during summarization and analysis, you should recommend data governance as the primary control layer.

guide AI strategy, ensure responsible AI oversight, and promote alignment across business units.

A trustworthy AI program requires more than technical implementation; it requires enterprise governance : clear ownership, risk management, policy, and cross-functional coordination. An AI governance council’s primary role is to provide strategic direction and oversight so AI initiatives align with business goals while meeting Responsible/Trustworthy AI expectations (fairness, reliability and safety, privacy and security, transparency, accountability, and inclusiveness).

Therefore, the best completion is that the council should guide AI strategy, ensure responsible AI oversight, and promote alignment across business units . This captures why councils are created: to avoid siloed deployments, define guardrails and approval processes, standardize evaluation/monitoring practices, and coordinate stakeholders such as legal, compliance, security, data governance, HR, and business leadership. The council also helps prioritize use cases, establish policies for data use and access, set documentation requirements, and require ongoing monitoring and incident response for AI systems in production.

The other options are narrower operational responsibilities. Configuring and deploying models in Azure is typically owned by engineering/cloud teams. Day-to-day model training and labeling is handled by data science/ML teams. The council sits above those activities to ensure the organization’s AI work is consistent, accountable, and strategically aligned .

A pretrained generative AI model is trained initially on a large, broad, and diverse dataset so it learns general language (or multimodal) patterns and capabilities. Fine-tuning then takes that pretrained base and performs additional training on a smaller, task- or domain-specific dataset to specialize behavior—improving performance for a particular use case, tone, style, or domain knowledge representation. That is exactly what option C states, making it the correct answer.

Option A is incorrect because both pretraining and fine-tuning may use labeled or unlabeled data depending on the technique; the distinction is not “labeled vs. unlabeled.” Option B is incorrect because a pretrained model is not “faster to train” due to fewer parameters; pretraining is typically the most compute-intensive phase precisely because it’s done at large scale, while fine-tuning is smaller but still trains the same model architecture. Option D is reversed: the pretrained model is the general-purpose foundation, while the fine-tuned model is the specialized variant for a specific task or dataset.

Answer Area

Content filtering controls can prevent AI-generated responses from exposing confidential and sensitive information. Answer: Yes

AI-generated content can unintentionally reveal sensitive information if the generative AI model has access to unsecured data sources. Answer: Yes

To prevent data exposure, only the prompts used by users must be protected by using policies. Answer: No

Yes — Content filtering (and related safety controls) can help reduce the chance that responses contain policy-violating or sensitive outputs by detecting and blocking certain categories of content. While filtering is not a perfect guarantee, it is a recognized control to prevent or reduce exposure risk in outputs (for example, blocking regulated data patterns, disallowed content categories, or unsafe disclosures).

Yes — If a model (or the solution’s retrieval layer) can access poorly governed repositories—such as broadly shared folders, misconfigured SharePoint sites, or unsecured databases—then the system can surface sensitive information in responses even without malicious intent. This is why access control, data classification, and permission hygiene are critical prerequisites for deploying AI assistants grounded in organizational content.

No — Protecting only user prompts is insufficient. Data exposure can occur through multiple paths: retrieved documents, generated outputs, logs/telemetry, training/fine-tuning data, and connector/index configuration. Preventing exposure requires layered controls: data governance (labels, DLP, least privilege), secure connectors, output filtering, auditing, and user training—not prompt policy alone.

Answer Area

Protect personal information and apply strong safeguards to keep data secure. Answer: Privacy and security

Make AI solutions understandable by explaining how and why decisions are made. Answer: Transparency

Design AI solutions that are accessible to people of all abilities and experiences. Answer: Inclusiveness

Involve human oversight in the control of AI solutions. Answer: Accountability

Microsoft’s Responsible AI principles provide a practical framework for building and deploying trustworthy AI systems.

Privacy and security is the principle focused on protecting personal information and ensuring strong safeguards—such as least privilege access, encryption, DLP controls, secure storage, and auditing—so data remains protected throughout collection, processing, and usage.

Transparency is about making AI systems understandable. This includes communicating when AI is being used, explaining system capabilities and limitations, and providing clarity on how outputs are produced (for example, what data sources are used, what assumptions apply, and why certain recommendations are generated). Transparency reduces confusion and helps users calibrate trust appropriately.

Inclusiveness ensures AI solutions are designed to benefit people of diverse abilities, backgrounds, and experiences. Practically, this includes accessibility (assistive technologies, readable outputs), inclusive UX design, and testing across diverse user groups so the solution does not exclude or disadvantage certain populations.

Accountability emphasizes that humans and organizations remain responsible for AI outcomes. Involving human oversight is a direct expression of accountability: setting governance, defining who owns decisions, establishing escalation paths, and ensuring there are controls for review, intervention, and correction when AI outputs are unsafe or incorrect.

Construction blueprints in PDFs often contain a mix of text, symbols, linework, and diagrams . The requirements include understanding both visual layout (where systems are located) and textual annotations , producing summaries, and answering Q & A. That combination requires a multimodal generative AI approach—models that can reason over images and text together. Therefore, A is best.

OCR alone (B) can extract printed text, but it won’t reliably interpret diagram geometry, symbols, or spatial relationships (e.g., “electrical riser is on the east core near gridline B-4”). Text completion (C) is too generic and doesn’t address image understanding. Document summarization (D) is only one requirement (summary) and still depends on first extracting/understanding both visual and textual elements.

A multimodal solution can ingest the PDF pages as images (or rendered page images) plus extracted text, then answer questions grounded in both modalities. In practice, you may combine OCR and layout extraction with a multimodal LLM so the model can reference drawing regions, legends, callouts, and system diagrams to produce accurate explanations and field extractions.

To reduce Azure OpenAI costs with minimal quality loss, you target the biggest cost drivers: token usage and model price per token (or throughput unit). C (Optimize the prompts) is a best practice because shorter, clearer prompts reduce unnecessary input tokens and often reduce output length by tightening instructions and formatting. Prompt optimization can preserve or even improve quality by removing ambiguity, adding constraints, and using compact context (for example, only the most relevant grounding passages). Lower token consumption directly lowers cost while maintaining response usefulness.

D (Switch to an alternate model) is also effective because different models have different price/performance tradeoffs. Moving from a premium model to a more cost-efficient model (or a smaller variant) can significantly reduce spend. You can minimize quality impact by validating outputs on representative scenarios and using a tiered approach (cheap model by default, expensive model only for complex cases).

The other options are less aligned to the goal. A (Fine-tune) typically increases cost (training and ongoing evaluation) and is not the first-line cost reducer. B (Content moderation) is primarily a safety control; it can add overhead and doesn’t directly reduce token costs. E (Decrease hosting hours) applies to capacity-based hosting scenarios, but the question states a prebuilt Azure OpenAI model for content generation—cost reduction is best achieved by prompt/token optimization and selecting the right model.

model inaccuracy

The scenario describes a model producing plausible-sounding content that is factually wrong —a common generative AI failure mode often referred to as a “hallucination.” Since “hallucination” is not offered in the dropdown, the best matching choice is model inaccuracy because the core problem is that the model’s output is incorrect even though it appears confident and coherent.

The other options do not fit the definition of the behavior: data leakage is about sensitive information being exposed (for example, proprietary prompts, secrets, or personal data). Prompt injection is an attack technique where a user tries to override system instructions or cause unsafe actions. Overreliance describes a human/organizational risk —trusting the model too much—rather than the model’s intrinsic behavior of generating incorrect facts. Overreliance can be a consequence of this behavior, but it is not what the behavior itself is called.

In practice, you mitigate this kind of inaccuracy by grounding responses in trusted sources (for example, RAG), constraining prompts with explicit requirements, using verification steps (citations, cross-checking, tool-based validation), and adding human review for high-impact use cases.

Answer Area

You can use Azure Language in Foundry Tools to analyze the sentiment of customer reviews. Answer: Yes

You can use Azure Language in Foundry Tools to translate internal reports into multiple languages. Answer: No

You can use Azure Language in Foundry Tools to extract text from scanned documents. Answer: No

Azure Language is designed for natural language processing (NLP) over text that is already machine-readable. That includes capabilities like sentiment analysis , key phrase extraction, entity recognition, summarization, and classification. Therefore, statement 1 is Yes : sentiment analysis of customer reviews is a standard NLP workload where the service scores text as positive/negative/neutral (and often provides confidence scores), helping organizations quantify customer satisfaction and detect recurring issues.

Statement 2 is No because translation is typically handled by a dedicated translation capability (commonly delivered as a separate translator service) rather than the core “Language” NLP features. While translation is an AI language workload, it’s not what the Azure Language service is primarily used for in this context; the expected Microsoft service choice for multi-language translation is the translator capability, not Azure Language.

Statement 3 is No because extracting text from scanned documents is OCR (optical character recognition), which is a computer vision/document processing function. OCR is delivered through Azure Vision and/or Azure Document Intelligence , which can read printed/handwritten text from images and PDFs and return structured output. Azure Language can analyze extracted text after OCR, but it does not perform the image-to-text extraction step itself.

An AI governance council (often called an “AI Council”) exists primarily to set direction and provide cross-functional oversight so AI adoption stays aligned to the organization’s values, risk posture, and Responsible AI commitments. That maps most directly to D . Microsoft’s guidance on creating an AI Council describes leadership responsibilities such as defining and communicating the organization’s AI vision, values, and policies , reviewing and approving AI use cases/projects, and coordinating with enablement and technical readiness teams to understand risks, issues, and opportunities. It also emphasizes representation across distinct functions (for example: senior leadership, legal, compliance, risk, ethics, data, technology, business, HR) to ensure governance decisions reflect a broad, accountable perspective.

The other options describe activities that may be supporting outcomes of governance, but they are not the council’s primary purpose. A is narrow (IT policy enforcement/user monitoring) and is typically handled by security/compliance operations rather than the top-level governance body. B is user enablement/training (commonly owned by adoption/change management teams). C focuses on technical delivery and performance management (often owned by engineering/MLOps/service owners). The governance council’s central value is strategic guidance + oversight + cross-functional alignment to ensure Responsible AI adoption is consistent, accountable, and sustainable across the business.

uses structured data and provides insights by using text, charts, tables, and other visuals.

The Analyst agent in Microsoft 365 Copilot is positioned as a “data analysis” reasoning agent that helps users work through structured information (for example, tables, spreadsheets, and other dataset-like inputs) and then produces analytical outputs . The best completion is the option stating it “uses structured data and provides insights by using text, charts, tables, and other visuals,” because that describes the hallmark outcome of analyst-style work: summarizing patterns, highlighting key drivers, and presenting results in formats that business users can act on. Analyst-style assistance typically includes exploring the data, identifying trends and anomalies, comparing segments, and explaining findings clearly—often accompanied by tables and visual representations that make the insights easier to consume.

The other dropdown options align to different use cases: “compiles background research for a new market or initiative” describes a research-oriented agent, “generate audio summaries” is a media summarization function, and “answer employee FAQs” describes a conversational knowledge assistant. Analyst is the one most directly associated with structured-data interpretation and producing a mix of narrative plus analytical artifacts (tables/charts) to communicate conclusions.

Grounding in generative AI means ensuring model outputs are based on trusted, relevant information sources rather than only on the model’s general training data. In a business context, grounding is about aligning responses with verified enterprise knowledge (policies, product documentation, internal procedures, approved FAQs, etc.) so the system is more accurate, consistent, and defensible. That is exactly what option D describes: “ensuring that verified company data sources are used for response generation.”

In Microsoft AI solution patterns, grounding is commonly achieved using retrieval-augmented generation (RAG). With RAG, the system retrieves relevant passages from approved company repositories (for example, indexed documents or knowledge bases) and supplies them as context to the model during response generation. This reduces hallucinations, improves factual correctness, and makes answers more relevant to the organization’s reality—critical when AI is used for customer support, employee helpdesks, compliance guidance, or executive reporting.

The other options do not directly address grounding. A relates to localization/multilingual capability, B is a usage/telemetry metric, and C is an interaction method (natural language interface). They can all be important requirements, but none of them ensure outputs are anchored to verified company data—the core purpose of grounding.

The correct answer is A. transparency. Transparency means users and stakeholders should understand when AI is being used, what the AI system can do, what its limitations are, and how important outputs or decisions were produced. In this scenario, applicants can request an explanation for why a loan application was denied. That explanation capability makes the AI-assisted decision more understandable and reviewable, which directly supports transparency. Fairness is related to avoiding unjust bias or discriminatory outcomes. Privacy and security focus on protecting personal and organizational data. Inclusiveness focuses on ensuring AI systems work for people with different abilities, backgrounds, and experiences. Because the scenario is specifically about explaining a decision, the best answer is transparency.

Microsoft Foundry is positioned as a unified, enterprise-grade platform that helps organizations build, deploy, scale, and govern AI apps and agents—especially generative AI solutions that need to work with business context and internal data. That directly aligns with A : Foundry provides a scalable platform for developing and deploying generative AI solutions. Microsoft describes Foundry as an interoperable platform that makes it easier to build, deploy, and scale AI apps and agents, while also providing centralized security and governance features for organizations.

B is incorrect because Foundry does not remove model choice/configuration; in fact, it supports selecting among models and using tools/frameworks to build solutions. You still choose appropriate model(s), configure endpoints, and design grounding and safety controls.

C and D are not the best characterization of Foundry’s primary benefit. While Foundry offers “friendly interfaces,” Microsoft primarily positions it for developers, model builders, and enterprise AI operations —not as a low-code platform for business users (that role is more commonly filled by Copilot Studio/Power Platform).

For a user to access organizational data from a mobile device, the user needs a Microsoft 365 Copilot license. No

To reason over your organizational data by using Microsoft Graph, you need a Microsoft 365 Copilot license. Yes

To use the Analyst agent, you need a Microsoft 365 Copilot license. Yes

Top of Form

Bottom of Form

The key distinction here is between Copilot Chat capabilities available with a standard Microsoft 365 subscription and the full Microsoft 365 Copilot add-on that enables richer, in-context experiences grounded in organizational data.

Mobile access to organizational data does not inherently require a Microsoft 365 Copilot license. Microsoft’s Microsoft 365 Copilot app (and related mobile experiences) can provide Copilot Chat for work/school accounts with a Microsoft 365 license, so simply accessing organizational content on a mobile device is not the same as having the paid Copilot add-on. The statement claims a Copilot license is required just to access org data from mobile, which is too broad—there are mobile Microsoft 365 apps that access org data without the Copilot add-on.

Reasoning over organizational data via Microsoft Graph is a core value proposition of Microsoft 365 Copilot. Microsoft documents explain that Microsoft 365 Copilot connects LLMs to your organization’s content and context through Microsoft Graph and generates responses “anchored” in organizational data. That deeper integration is tied to the Microsoft 365 Copilot experience (an add-on license).

Analyst is a “reasoning agent” within Microsoft 365 Copilot and Microsoft states that users with a Microsoft 365 Copilot license can use Analyst (with defined usage limits). Therefore, the Analyst agent requires the Microsoft 365 Copilot license.

create a Microsoft Word document.

Microsoft 365 Copilot is a productivity-focused AI capability embedded across Microsoft 365 apps such as Word, Excel, PowerPoint, Outlook, and Teams. A core, common use case is drafting and generating documents in Word from prompts and existing context. Therefore, “create a Microsoft Word document” is the best completion.

The other options are not appropriate for Microsoft 365 Copilot’s scope. “Monitor network traffic and alerts in real time” is a security/operations function more aligned to security monitoring tools and, in Microsoft’s product set, closer to Microsoft Security Copilot or dedicated SIEM/SOAR platforms (for example, Microsoft Sentinel). “Modify administrative permissions for SharePoint files” is an admin/governance action that is intentionally protected by role-based access control and is not something end-user Copilot features are meant to perform as a default capability. “Create a list in Microsoft SharePoint” is closer, because Copilot can assist in generating content and can work within Microsoft 365 collaboration contexts; however, the most universally accurate and directly supported capability among the options is creating/drafting a Word document, which is a primary Copilot scenario in Word.

In short, Microsoft 365 Copilot is designed to help users create, summarize, rewrite, and transform content within Microsoft 365 apps, and document creation in Word is a canonical example of that value.

The correct answer is B. Testing the AI solution to identify and mitigate unfair or inconsistent outcomes directly supports Microsoft responsible AI principles, especially fairness, reliability and safety, accountability, and inclusiveness. Before deployment, organizations should evaluate whether the system behaves consistently across different user groups, avoids discriminatory outcomes, and produces safe and reliable outputs. Automatically approving or rejecting loan applications increases risk unless strong governance and human oversight are in place. Collecting personal data can increase privacy exposure if it is not necessary and controlled. Prioritizing model performance alone is also insufficient because a technically accurate model can still produce biased, unsafe, or non-transparent outcomes. Responsible AI requires evaluation, mitigation, oversight, and monitoring.

When AI adoption spans multiple business units, the primary risk is fragmented delivery: inconsistent standards, duplicated spend, uneven risk controls, and misalignment with enterprise strategy. Establishing an AI council (D) is the best approach because it creates a cross-functional governance mechanism that aligns AI initiatives to business priorities while enforcing Responsible AI practices consistently.

An AI council typically includes senior stakeholders from business leadership, IT, security, legal, compliance, privacy, data, and HR. Its role is to define AI principles and guardrails, approve high-impact use cases, set policy for data usage and access, establish evaluation and monitoring requirements, and coordinate change management and training. This also enables portfolio management—deciding which projects to prioritize, reuse, or stop—so AI investments map to measurable business outcomes.

The other options are weaker: A encourages siloed deployments and inconsistent risk management. B centralizes too narrowly in IT; Responsible AI requires broader accountability than a single function. C can help delivery capacity but does not replace internal governance; vendors still need direction, controls, and oversight from the organization.

The requirement is specific: users must build and use declarative agents that can access work data (tenant data / organizational context). Microsoft’s licensing guidance for Copilot extensibility ties use of declarative agents to having the appropriate Copilot entitlement that enables tenant grounding and organizational data access. In Microsoft’s cost and licensing considerations for declarative agents, Microsoft states that to use a declarative agent, users must have a Microsoft 365 Copilot add-on license (or an equivalent Copilot Chat add-on path tied to eligible licensing). Therefore, among the provided options, the best recommendation is A.

Option B (Copilot Studio user license) is primarily about authoring/building agents in Copilot Studio, but it is not, by itself, the licensing prerequisite that grants end users the right to use those agents with full Microsoft 365 Copilot capabilities and work-data grounding inside the Microsoft 365 Copilot environment. Publishing/building can be separate from the end-user entitlement to use the agent with organizational context.

Option C (Copilot Chat pay-as-you-go) can enable usage-based access to declarative agents in some configurations, but the question asks for the best license recommendation for users who need work-data access through declarative agents. The Microsoft 365 Copilot add-on is the straightforward, fully supported entitlement for that scenario.

Generative AI’s defining characteristic is that it creates new content (text, images, code, summaries, drafts) in response to instructions—most commonly natural language prompts. Option C captures that general-purpose description in a stakeholder-friendly way: users provide prompts and the system generates responses or content. This framing is broad enough to cover common business value scenarios such as summarizing documents, drafting communications, creating marketing copy, generating reports, building assistants, and producing structured outputs from unstructured requests.

Option A is a single use case (translation), not the defining description. Option B describes predictive analytics/forecasting, which is a different AI category focused on outcomes and probabilities rather than content creation. Option D describes recommendation systems, typically driven by ranking/behavioral signals; while AI can enhance recommendations, that is not the core definition of generative AI. Therefore, the most accurate and relevant description for stakeholders is C.