Microsoft AI-500 Practice Exam Questions & Answers

Both stated restrictions concern content that must not appear in the agent's final output. A custom blocklist should therefore be applied to agent output so the two sanctioned company names are detected before a response is returned. The customer-account requirement likewise belongs at the output boundary, where PII/sensitive-data detection can identify protected identifiers in generated content. Applying the controls only to user input would not stop the model from generating the prohibited names or identifiers itself. Task Adherence focuses on whether agent behavior stays within assigned procedures and is not a substitute for explicit output filtering. Microsoft Foundry guardrails are designed to attach controls to the intervention point where the relevant risk occurs. Because the risk is disclosure in the response, option C is the configuration that places both controls at the correct boundary. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points

The updated guardrail must be evaluated with known benign and adversarial cases so false positives and false negatives can be measured explicitly. Running labeled cases through every relevant workflow path also tests whether the guardrail is applied consistently at the intended intervention points. Microsoft AI-500 guidance includes guardrail testing with synthetic or curated data and emphasizes evaluation before production rollout. Playground-only spot checks are too narrow to establish coverage. Switching production to annotate-only would change live behavior and use customers as the test population, violating the requirement to avoid production changes. A compliance configuration review verifies that a policy exists but does not measure whether it correctly detects or misses real inputs. Option B is therefore the only approach that produces repeatable evidence of intervention accuracy and policy coverage without changing production behavior. A robust evaluation program separates process metrics from final-response metrics. The selected answer measures the layer where the stated failure actually occurs, which is essential for deciding whether to change retrieval, orchestration, prompt behavior, or the final generator.

Official Microsoft reference: AI-500 Study Guide - guardrail testing and evaluation

The fastest safe rollback is to route the stable endpoint back to the previous known-good immutable agent version. Current Foundry lifecycle guidance supports versioned agents and endpoint/version selection so production traffic can be redirected without rebuilding the agent from scratch. Deleting the newly published version is a destructive cleanup action and is not the preferred rollback mechanism because it removes an artifact that may be needed for diagnosis. Creating a new agent changes the lifecycle identity and takes longer, while a complete redeployment is unnecessary if the earlier version already exists. Option C is therefore correct when interpreted as changing the endpoint's active-version or version-selector configuration to the previous version while keeping the endpoint URL stable. From a security and governance perspective, the control should be enforced at the narrowest platform boundary that can deterministically block or constrain the action. Relying only on prompt text is weaker because the model can still be induced to behave unexpectedly.

Official Microsoft reference: Microsoft Foundry agents - development lifecycle and versioning

The requirements ask for behavior that applies to every future conversation, improves routing for representative compound inputs, and standardizes final output with minimal application-code change. Few-shot instruction examples satisfy all three by demonstrating both the desired routing decision and the expected schema-compliant response for representative cases. Repository-wide constraints list rules but do not demonstrate how ambiguous compound requests should be handled. Per-request prompt cues are not durable across future conversations and would require application logic to inject them repeatedly. System role instructions define domains and objectives but provide less behavioral specificity than examples. Microsoft AI-500 prompt-engineering objectives explicitly include examples and dynamic prompt techniques for shaping complex agent behavior. Therefore C is the strongest design. The implementation should also preserve clear inputs and outputs around this step so that later agents receive only the information they require. This improves debuggability and keeps token, permission, and state growth under control as the workflow becomes more complex.

Official Microsoft reference: AI-500 Study Guide - advanced prompt engineering

The review process must cover the full sensitive interaction, including third-party calls, prompts, intermediate steps, and tool actions, and it must feed a governance review process. A centralized sensitive-use intake combined with guardrails and tracing provides the required evidence, while human reviewers must be able to approve, edit, or reject flagged interactions rather than reviewing only the final message. Content Safety alone does not provide full process governance over tool use. Routing only subagent findings or requiring approval only for the final response misses earlier third-party actions. CI/CD evaluation is important for release quality but does not control individual flagged production interactions. The source duplicated the label C for the final option; that final option should be labeled D. With that label correction, D is the best answer. From a security and governance perspective, the control should be enforced at the narrowest platform boundary that can deterministically block or constrain the action. Relying only on prompt text is weaker because the model can still be induced to behave unexpectedly.

Official Microsoft reference: AI-500 Study Guide - governance, guardrails, tracing, and HITL

The workload mixes simple prompts, reasoning-heavy tasks, and tool-calling workflows, so a single premium model is over-provisioned for many requests. Microsoft Foundry's model router evaluates request complexity and routes each request to an appropriate model from a configured pool. Simple work can use lower-cost, lower-latency models, while complex reasoning can still be assigned to a more capable model. Structured outputs constrain response format but do not reduce model capability according to request complexity. Prompt Optimizer can improve prompt quality but does not perform per-request model selection, and choosing another flagship model would preserve the same all-requests-use-premium pattern. Therefore A directly addresses the cost and latency variability by matching model capacity to workload complexity. A robust evaluation program separates process metrics from final-response metrics. The selected answer measures the layer where the stated failure actually occurs, which is essential for deciding whether to change retrieval, orchestration, prompt behavior, or the final generator.

Official Microsoft reference: Microsoft Foundry - Model router