AI-103 Developing AI Apps and Agents on Azure Questions and Answers

Call client.videos.create() to submit the prompt and start a video-generation job against the model deployment. Video generation is asynchronous: the initial response represents a job and contains properties such as its unique ID and current status rather than immediately returning the completed video. Microsoft’s official Python example creates the job by using client.videos.create(model=..., prompt=...).

The application must then poll the job. After waiting between requests, client.videos.retrieve(video.id) obtains the latest state of that specific job. Polling continues until the status becomes completed, failed, or cancelled. list would enumerate jobs rather than refresh the selected job, while download_content is used only after successful completion to retrieve the generated video file.

To comply with Contoso’s prohibition on API keys, the client should use a Microsoft Entra bearer-token provider. The OpenAI Python client accepts this provider through its api_key constructor parameter even though no static API key is used.

Study Guide alignment: design and implement video-generation solutions and integrate generative workflows through Foundry SDKs.

credential = DefaultAzureCredential()

agent = project_client.agents.get(agent_name=myAgent)

The correct authentication option is DefaultAzureCredential() because the case study states that API keys must not be used to access Foundry-deployed models and that Contoso developers must authenticate to Microsoft Foundry resources by using Microsoft Entra authentication. It also states that access to Project1 must be assigned to Agent1Dev Team by using the security group SC_Agent1_Dev . Microsoft Foundry authentication guidance recommends Microsoft Entra ID for production workloads because it supports least-privilege RBAC, per-principal auditing, and keyless authentication. AzureKeyCredential() would violate the no-API-key requirement, and None would not provi de a valid credential.

The correct agent operation is get because the task is to access an existing agent named Agent1, not create a new version or retrieve a specific published version. Microsoft Foundry SDK examples show AIProjectClient created with DefaultAzureCredential() and then using project agent operations to create, retrieve, or interact with agents by name. To meet the compliance requirement, the group SC_Agent1_Dev must also be granted the appropriate project-scoped Foundry role, such as Foundry User, for Project1. Reference topics: Microsoft Entra authentication, Foundry RBAC, AIProjectClient, and project agent access.

The correct recommendation is Azure AI Search. The case study states that the product detail sheets are stored as PDFs in storage1, and that Agent1 must be enabled to retrieve and use detailed product information from those sheets. It also specifies that the indexing pipeline must enable semantic and vector search, and that Agent1 must answer natural language questions about product details by using the product sheet information. Azure AI Search is the Azure service designed to ingest content from sources such as Azure Blob Storage, create searchable indexes, and support keyword, semantic, hybrid, and vector retrieval for Retrieval Augmented Generation (RAG) solutions.

Microsoft’s Azure AI Search guidance states that integrated vectorization can chunk content and generate embeddings during indexing, enabling vector search over source documents. It also states that Azure AI Search supports text and vector queries and can improve raw content for search-related scenarios through enrichment pipelines. Azure Translator is unrelated to retrieval. Document Intelligence can extract document structure, but it is not the retrieval index for Agent1. Grounding with Bing Search retrieves public web content, not Contoso’s private PDFs in storage1. Reference topics: Azure AI Search, RAG, semantic search, vector search, Azure Blob Storage indexing, and agent grounding.

Deployment type: Standard

Version update policy: Once the current version expires

The correct deployment type is Standard . The case study specifies that Project1 is deployed in an EU Azure region and that model-processed data must remain within the EU. It also requires scalable, high-throughput generative AI workloads that dynamically handle variable customer support traffic without reserved throughput capacity. In Microsoft Foundry Models, Standard is a pay-per-token deployment type that processes data in a single Azure region, while Global Standard can process requests across regions and Global Provisioned uses reserved provisioned throughput. Microsoft’s deployment-type guidance identifies Standard as single-region, pay-per-token, whereas Global Provisioned is cross-region with reserved capacity.

The correct version update policy is Once the current version expires . This keeps Agent1 on the selected model version during its supported lifecycle, which supports stable and consistent responses, but still preserves continuity by automatically moving to a supported replacement when the current version is retired. Microsoft’s model versioning guidance states that this policy updates only when the current model version expires, while upgrading when a new default is available changes the deployment sooner and opting out can cause the deployment to stop working after retirement. Reference topics: deployment types, regional data processing, model versioning, throughput capacity, and stable production deployments.

Foundry Control Plane obtains agent observability information from the Application Insights resource connected to the Foundry project that hosts the agent. When the telemetry is available, Control Plane uses it to calculate run counts and error rates, report usage metrics such as token consumption and cost, and display execution traces. Microsoft’s guidance explicitly directs administrators to configure Application Insights when these values are absent.

Application Insights must be connected to the project, and the agent or application must emit the applicable OpenTelemetry data. Traces are stored in Application Insights and surfaced through both the Foundry portal and Azure Monitor. Microsoft’s tracing procedure requires connecting an Application Insights resource to the Foundry project before trace records can be displayed.

A Log Analytics workspace can provide the underlying storage for a workspace-based Application Insights resource, but assigning a workspace alone does not configure the project’s agent telemetry connection. Restarting Agent1 does not add instrumentation or a telemetry destination. Creating a new agent version also does not resolve the missing observability configuration.

Study Guide alignment: Integrate monitoring into deployed agents and set up observability by implementing tracing, token analytics, safety signals, latency analysis, and error investigation.

To prevent access from the internet: Create a private endpoint

To limit access to query specific indexes: Use Azure roles

Create an Azure Private Link private endpoint for Search1 and disable public network access. The private endpoint assigns Search1 a private IP address within an Azure virtual network, allowing the hosted applications to reach the search service over the Microsoft backbone instead of through its public endpoint. Disabling public network access ensures that requests originating from the public internet are rejected. An IP firewall would still expose the public endpoint to approved public IP addresses and therefore would not provide complete internet isolation.

For index-level authorization, enable Microsoft Entra ID role-based access control and assign Azure roles to each application’s managed identity or service principal. The Search Index Data Reader role permits query and retrieval operations without allowing index modification. Azure AI Search supports scoping Search Index Data Reader or Search Index Data Contributor permissions to an individual index; custom role definitions can also be used when more precise permissions are required.

Query-key authentication is unsuitable because API keys normally provide service-level access and cannot reliably isolate applications to designated indexes.

Study Guide alignment: secure Azure AI services by configuring private endpoints, network isolation, managed identities, Microsoft Entra authentication, and role-based access control.

The correct solution is to configure an Azure AI Search connection in Project1 and reference that connection from each application. Microsoft Foundry project connections are intended to centralize external resource configuration for a project. The official Foundry guidance states that when adding a connection, you select the external service, such as Azure AI Search , and choose the authentication method for that resource. This directly satisfies the requirement for multiple client applications to use the same search configuration instead of duplicating endpoints, indexes, and credentials in each app.

The security requirement is met by configuring the connection with keyless authentication. The Azure AI Search integration guidance specifies that a Foundry project connection requires the search endpoint and either key-based authentication or keyless authentication with Microsoft Entra ID . For keyless authentication, RBAC roles are assigned to the project’s managed identity, eliminating hard-coded API keys.

Options A and C use secure identity-based access but force every client application to maintain its own Azure AI Search configuration, increasing administration and violating the shared-configuration requirement. Option B also increases administrative work and does not use the native Azure AI Search connection type. Reference topics: Microsoft Foundry project connections, Azure AI Search grounding, Microsoft Entra ID authentication, managed identities, and RBAC.

Agent1 requires memory because the business requirement explicitly states that the agent must retain conversation context and recall relevant information during future interactions. Microsoft Foundry Agent Service memory provides persistent knowledge that can be retained and retrieved across separate conversations, sessions, devices, and workflows. It can store meaningful information extracted from prior interactions, including user preferences, relevant facts, and summarized context, and then retrieve that information when personalizing later responses.

Short-term memory maintains context within the current conversation. Long-term memory supports continuity across future sessions, which directly addresses Contoso’s requirement. Memory scopes should be associated with individual user identities so that one customer’s stored information cannot be retrieved during another customer’s interaction.

Guardrails enforce safety or behavioral restrictions but do not provide conversation recall. Tools enable the agent to access external systems, while instructions define the agent’s role and operating boundaries. Neither tools nor instructions persist user-specific information across sessions.

The AI-103 Study Guide maps this requirement to choose appropriate memory, tool, and knowledge integration services and build agents that integrate retrieval, function calling, and conversation memory .

====================

The correct answer is B. Modify the system message instructions . The case study states that Agent1 answers general questions about Contoso products and that the business requirement is for Agent1 to answer questions only about the products sold by Contoso . This is a behavioral boundary for the agent, so it should be implemented in the highest-priority instructions that define the agent’s role, allowed scope, and refusal behavior.

Microsoft Foundry guidance states that a system message is used to steer model behavior, define the assistant’s role and boundaries, and add safety or quality constraints for the scenario. The system message should instruct Agent1 to answer only when the question concerns Contoso products, use the configured Contoso product documentation as grounding, and politely refuse or redirect questions about non-Contoso products.

Top-p sampling and temperature control randomness, not business-domain scope. Increasing temperature would make responses less deterministic. Few-shot examples can support desired behavior, but examples alone are weaker than explicit system-level instructions for defining operating boundaries. Reference topics: system message design, prompt engineering, agent instructions, response constraints, and grounded generative AI behavior.

The correct built-in analyzer is prebuilt-layout because the requirement is to preserve document layout while extracting content from scanned PDFs. Microsoft’s Content Understanding prebuilt analyzer guidance states that prebuilt-layout extracts content and layout elements such as words, figures, paragraphs, and tables, identifies document structure including sections and formatting, and provides detailed layout information beyond basic text extraction. It also states that prebuilt-layout does not require a language model or embedding model, which directly satisfies the no language model deployment requirement.

QR codes are handled through barcode extraction. The analyzer configuration reference states that enableBarcode detects and extracts barcodes and QR codes, returns decoded values, and supports QR Code and Micro QR Code among other barcode types. This option is supported by document-based analyzers, making it compatible with layout-oriented document processing.

prebuilt-read is insufficient because it provides OCR and barcode extraction but foundational text extraction without layout analysis. prebuilt-documentSearch is optimized for RAG ingestion and semantic analysis, which is broader than required. prebuilt-documentFieldSchema proposes extraction schemas rather than extracting full document layout. Reference topics: Content Understanding prebuilt analyzers, layout analysis, OCR, barcode detection, QR code extraction, and document-based analyzers.

The correct built-in skills are Azure OpenAI Embedding and Text Split. The case study requires an indexing pipeline that enables semantic and vector search over the product sheets stored in Azure Blob Storage, so Agent1 can retrieve relevant product information for natural language customer questions. For a RAG pipeline, long PDF content must first be broken into retrievable chunks, and each chunk must then be vectorized for semantic similarity retrieval.

Microsoft’s Azure AI Search integrated vectorization guidance states that you create a skillset that calls the Text Split skill for chunking and the Azure OpenAI Embedding skill to vectorize the chunks. The Text Split skill breaks text into chunks and provides positional metadata, making it suitable when downstream embedding skills have input-length limits. The Azure OpenAI Embedding skill connects to an embedding model deployed in Azure OpenAI or a Microsoft Foundry project and generates embeddings during indexing.

Language Detection, Entity Recognition, and key phrase extraction can enrich text, but they do not create vector embeddings. Merge is useful for combining OCR text with document text, but it does not satisfy the core vector-search requirement. Reference topics: Azure AI Search skillsets, Text Split skill, Azure OpenAI Embedding skill, integrated vectorization, and RAG indexing.

The correct answer is B. Personally Identifiable Information (PII) Detection . The case study states that Agent1 must never reveal customer information , even if a document containing customer data is added accidentally to the product sheet repository in storage1. This is a privacy and compliance control requirement, so the appropriate capability is PII Detection.

Azure Language PII Detection is a Foundry Tools capability that identifies, classifies, and redacts sensitive information across text, conversations, and native documents. Microsoft states that PII Detection can be used to implement privacy controls, reduce sensitive data exposure, and support compliance requirements. In this scenario, PII Detection should be applied to retrieved product-sheet content and generated responses so customer names, contact details, identifiers, and other sensitive values are not exposed to users.

Prompt Shields are important for a separate requirement: protecting Agent1 from malicious instructions hidden in documents or embedded text. Microsoft describes Prompt Shields for documents as protection against hidden instructions embedded in external content. However, the option that directly satisfies the requirement to prevent disclosure of customer information is PII Detection. Self-harm and violence filters address harmful-content categories, not privacy leakage.

The correct answer is B. Modify the system message instructions . The case study states that Agent1 answers general questions about Contoso products and that a business requirement is for Agent1 to answer questions only about products sold by Contoso. This requirement defines the agent’s allowed domain and refusal boundary, so it must be expressed in the agent’s system-level instructions. Microsoft Foundry guidance states that system messages steer Azure OpenAI chat model behavior and are used to define the assistant’s role, boundaries, output format, and safety or quality constraints.

The system message should instruct Agent1 to answer only Contoso-product questions, use Contoso product documentation when available, and decline questions about non-Contoso products. This directly enforces the intended business scope at the highest instruction level. Few-shot examples can reinforce desired behavior but are not the primary control for defining mandatory operating boundaries. Top-p sampling and temperature are decoding controls; they influence randomness and diversity, not whether the agent restricts answers to a specific product domain. Increasing temperature would likely reduce consistency. Reference topics: Microsoft Foundry agent instructions, system message design, prompt engineering, response boundaries, and grounded generative AI behavior.

credential = DefaultAzureCredential

response = openai_client.responses.create

The correct authentication class is DefaultAzureCredential because the requirement is Microsoft Entra-based authentication, and this credential supports managed identity in hosted Azure environments. The Microsoft Foundry quickstart for Python shows the project client being created with AIProjectClient(endpoint=PROJECT_ENDPOINT, credential=DefaultAzureCredential()), which enables the Foundry SDK to authenticate without using API keys or embedded secrets. The same guidance shows creating an OpenAI-compatible client from the project by calling project.get_openai_client().

The correct Responses API method is create because the application must send a new prompt to the deployed model and receive generated output. Microsoft’s Foundry quickstart demonstrates the exact pattern: response = openai.responses.create(model= " gpt-5-mini " , input= " ... " ), followed by reading response.output_text. The retrieve operation is used to fetch an existing response, not submit a new inference request, and compact is not the correct method for generating a model response. AzureKeyCredential would violate the Microsoft Entra managed identity requirement, while ClientSecretCredential uses an application secret rather than managed identity. Reference topics: Microsoft Foundry SDK, AIProjectClient, Microsoft Entra authentication, DefaultAzureCredential, and Azure OpenAI Responses API.

The correct answer is D. the custom speech project ID . For custom speech fine-tuning, the Speech to text REST API uses a project property that must refer to the Custom Speech project, not the general Microsoft Foundry project. Microsoft’s Custom Speech guidance states that when using the Speech to text REST API for custom speech, you must set the project property to the ID of your custom speech project. It also explicitly notes that the custom speech project ID is not the same as the Microsoft Foundry project ID.

This distinction explains the invalid project ID error. Supplying the Foundry project ID, project URL, or endpoint URL does not identify the Custom Speech project that owns the fine-tuned speech model. The custom speech endpoint URL is used when calling a deployed custom model endpoint for recognition, but it is not the value of the REST API project property. The project URL is also not accepted because the API expects the identifier value. Reference topics: Azure Speech in Foundry Tools, Custom Speech fine-tuning, Speech to text REST API, custom speech project ID, model publication, and endpoint configuration.

The solution does not fully meet the goal. A prompt shield for documents is the correct control for the embedded-instruction portion of the scenario. Microsoft defines Prompt Shields as protection against prompt manipulation, including attacks embedded in third-party or document-like content that is supplied to a generative model. OCR-extracted text from uploaded images is untrusted contextual content, so document attack protection is appropriate for detecting hidden instructions that attempt to override the model’s intended behavior.

However, the scenario contains two separate risks: unsafe image uploads and hidden instructions embedded in images. Prompt Shields for documents address indirect prompt injection, but they do not classify or block harmful visual content in the uploaded image itself. Azure AI Content Safety image moderation is the control that scans images for harmful content categories such as sexual content, violence, hate, and self-harm with severity levels that can be used for blocking decisions.

Therefore, document prompt shielding alone is incomplete. A complete mitigation would combine image moderation for unsafe images with Prompt Shields for document attacks, and optionally Spotlighting for lower-trust third-party content. Reference topics: Content Safety image moderation, Prompt Shields, document attacks, indirect prompt injection, and multimodal safety.

The correct capability is tracing because the requirement is to inspect the execution path of an individual agent run. Microsoft Foundry tracing captures detailed telemetry for agent behavior, including LLM calls, tool invocations, agent decision flows, inputs, outputs, tool results, token consumption, duration, and latency. This is the appropriate observability mechanism when you need to determine which step introduced a delay, whether the agent called the internal knowledge API, what data the tool returned, and how the model used that data before producing the final response. Microsoft’s Foundry observability guidance describes distributed tracing as the mechanism that provides visibility into LLM calls, tool invocations, agent decisions, and inter-service dependencies.

Token usage is useful for cost analysis and prompt optimization, but it does not show ordered run steps or tool-call sequencing. Safety metrics evaluate risk-related output behavior, not latency or tool execution. General monitoring provides aggregate health, latency, success-rate, and dashboard views, but the question asks for per-run sequence inspection and timing breakdowns. Foundry agent tracing specifically supports debugging unexpected behavior and monitoring latency across requests. Reference topics: Microsoft Foundry observability, agent tracing, OpenTelemetry-based traces, tool invocations, LLM call inspection, and latency diagnostics.

Use image type detection to distinguish drawings from ordinary photographic content. Azure Vision’s ImageType visual feature returns information including lineDrawingType, which indicates whether the submitted image is a line drawing, and clipArtType, which estimates whether it is clip art. The application can use these pretrained results to implement the required photograph-versus-drawing categorization without collecting labeled images or training a custom classifier.

Use image descriptions to generate the caption. Azure Vision Image Analysis provides the Caption visual feature, which generates a concise, one-sentence description of the overall image. Dense Captions can additionally describe individual regions, but the standard Caption feature directly satisfies the stated requirement.

Object detection identifies and locates individual objects by using bounding boxes; it does not determine whether the entire image is a photograph or drawing. Content tags produce descriptive keywords rather than a natural-language caption. Azure Custom Vision classification could be trained for the image-type distinction, but it would require image collection, labeling, training, evaluation, and deployment, increasing development effort unnecessarily.

Study Guide alignment: configure applications to produce captions and implement solutions that identify visual characteristics within images .

====================

Add the natural-language comment // what does function F do? after the code. The comment gives GPT-35 Turbo a direct and unambiguous instruction to analyze and explain function F. Because it uses syntax that naturally belongs beside source code, the model can distinguish the program being analyzed from the requested task and generate an explanatory completion. Microsoft’s prompt-engineering guidance recommends clearly stating the required outcome and using cues that direct the model toward the desired response.

This approach retains the existing GPT-35 Turbo deployment and adds only a small number of prompt tokens, satisfying the cost-minimization requirement. Changing to GPT-4-32k would be unnecessary because the requirement is a straightforward code-explanation task and does not indicate that a substantially larger context window is required.

Adding function F(explanation) resembles a new function declaration or invocation rather than an instruction to explain existing code. The model could interpret it as source code that must be completed. Setting temperature to 1 changes output randomness but does not tell the model to explain the function; it can also make the answer less consistent.

Study Guide alignment: Use prompt-engineering techniques, construct clear model instructions, tune generation behavior, and select an appropriate model based on quality and cost requirements.

====================

Prompt shields action: Set action to block.

Additional mitigation: Enable Spotlighting.

The correct configuration is to set the Prompt Shields document attack action to block and enable Spotlighting . Prompt Shields in Microsoft Foundry are designed to detect attempts to manipulate model behavior through adversarial input. Microsoft distinguishes document attacks from direct user prompt attacks: document attacks are malicious instructions embedded in third-party content such as documents, webpages, emails, or other externally supplied material. In this scenario, the embedded text inside uploaded screenshots is third-party content and can attempt to override the agent’s instructions. Setting the action to block prevents detected document-attack content from being processed normally, which is required because the goal is prevention rather than passive logging or annotation.

Spotlighting is the additional mitigation because it marks or transforms document content so the model treats it as lower trust than system and user instructions. Microsoft’s Foundry guidance describes Spotlighting as a Prompt Shields subfeature that helps protect against indirect or embedded document attacks by tagging input documents with special formatting to indicate lower trust. A custom blocklist is insufficient for unknown attacks, and OCR alone only extracts the malicious text; it does not mitigate prompt injection. Reference topics: Prompt Shields, document attacks, guardrails, Spotlighting, multimodal safety, and prompt injection defense.

The correct recommendation is B. Add a connection to the Azure AI Search resource . Microsoft Foundry project connections are used to centrally define access from a project to external resources, including Azure AI Search. The official connection guidance states that you can add a connection by selecting an external service such as Azure AI Search , choosing the resource, and selecting the authentication method for that resource. This creates a reusable project-level configuration rather than requiring each agent to store or duplicate search credentials independently.

For Foundry agents that use Azure AI Search, the Azure AI Search tool requires a project_connection_id, which is the resource ID of the project connection to Azure AI Search. This allows multiple agents to reference the same managed connection while using the configured endpoint and authentication settings consistently. RBAC may be part of a keyless authentication design, but it does not by itself create a centrally managed Foundry credential configuration. Disabling key-based access improves security posture but does not connect the agents. A managed private endpoint addresses network isolation, not credential centralization. Reference topics: Microsoft Foundry project connections, Azure AI Search tool, project connection IDs, authentication, and agent grounding.

First selection:

mcr.microsoft.com/azure-cognitive-services/textanalytics/sentiment

Second selection:

https://contoso.cognitiveservices.azure.com

Completed command:

docker run --rm -it -p 5000:5000 --memory 8g --cpus 1 \

mcr.microsoft.com/azure-cognitive-services/textanalytics/sentiment \

Eula=accept \

Billing=https://contoso.cognitiveservices.azure.com \

ApiKey=xxx

The image mcr.microsoft.com/azure-cognitive-services/textanalytics/sentiment is the official Microsoft Container Registry image for Azure AI Language sentiment analysis. The Billing argument must reference the endpoint of the provisioned Azure AI Language resource associated with the supplied API key. It is not the address used by applications to invoke the locally running container.

Azure AI containers require three licensing and metering parameters: Eula=accept, a valid Billing endpoint, and ApiKey. Without all three values, the container does not start. The command maps host port 5000 to container port 5000, allocates 8 GB of memory and one CPU, creates an interactive terminal, and automatically removes the stopped container. Applications subsequently invoke the locally hosted service through an address such as http:// < vm-address > :5000. The Azure endpoint remains responsible for metering and authentication; analyzed customer text is processed by the container rather than sent to the billing endpoint.

Study Guide alignment: Implement text analysis solutions — perform sentiment analysis and opinion mining, deploy Azure Language containers, and configure container billing parameters.