CertifyAIxAce every AI certification.

AI-103 sample questions with answers

10 free practice questions for the Microsoft Certified: Azure AI Apps and Agents Developer Associate exam. Try each one, then open the answer to see why the right option wins and every other option loses.

Question 1Plan and manage an Azure AI solution

An agent calls an MCP server that reads blobs. The project's managed identity already holds Storage Blob Data Contributor on the storage account, but the tool call is rejected by the storage account. What should you correct?

  1. A.

    Assign the role to the Foundry account's system-assigned identity instead of the project's

  2. B.

    Recreate the project connection using key-based authentication so that the storage account key is passed through with each tool call instead of an Entra ID token obtained for the agent identity

  3. C.

    Assign the role to the agent identity, because the managed identity only authenticates the blueprint and the agent identity is the principal the downstream resource authorises

  4. D.

    Grant the project managed identity the Foundry User role on the storage account

Show answer

Answer: C

The agent identity, not the project managed identity, is the principal that needs RBAC on the downstream resource.

  • A. Moving the assignment between Foundry identities does not help, because neither is the principal presented to the storage account.
  • B. Reverting to keys abandons the identity model the agent tool authentication is built on and would be rejected by governance requiring keyless access.
  • C. The agent identity is documented as the principal the downstream resource authorises; the managed identity only authenticates the blueprint.
  • D. Foundry User grants access to the Foundry project and is not a data-plane role on a storage account.
Question 2Plan and manage an Azure AI solution

After an egress policy was switched to Enforce, a hosted agent reports that one of its tool calls failed and then tries a different approach. Nothing in the agent's own logs names a policy. How do you confirm the egress policy caused it?

  1. A.

    Enable the ManagedNetworkEvent resource log category and query it for blocked hosts

  2. B.

    Inspect the network security group flow logs for the delegated agent subnet and correlate the denied flows with the timestamps of the failed tool calls

  3. C.

    Check the Foundry resource's activity log for a denied outbound connection entry

  4. D.

    Open the run's trace and read the Network egress decision span, which names the decision, the reason, the matched rule and the destination

Show answer

Answer: D

Egress decisions are emitted as a Network egress decision span in the agent's trace and in Application Insights, carrying the decision, reason, matched rule and destination.

  • A. That diagnostic category covers managed network events on the Cognitive Services resource, not hosted agent egress decisions.
  • B. Enforcement happens inside the Foundry-managed sandbox, so your own NSG flow logs never observe the decision.
  • C. The activity log covers control plane management operations, not individual outbound requests made at runtime.
  • D. The Network egress decision span is the documented record, carrying decision, reason, matched rule, enforcement mode and destination.
Question 3Plan and manage an Azure AI solution

After the storage account behind a grounding pipeline had public network access disabled, the indexer created by the Import data wizard stopped populating the index. No errors are reported and the index is empty. What must be changed?

  1. A.

    Move the search service into the same region as the storage account so that the private endpoint resolves

  2. B.

    Set the indexer's executionEnvironment to private, because the default multitenant environment cannot traverse private endpoints

  3. C.

    Switch the indexer schedule to on demand so that it runs while the firewall exception window is open

  4. D.

    Increase the indexer's Max failed items so that blocked documents no longer stop the run

Show answer

Answer: B

Indexers default to multitenant execution, which cannot reach private endpoints, and the failure is silent - an empty index with a successful-looking run.

  • A. Co-locating the services does not change the execution path, and IP range restrictions actually require them to be in different regions.
  • B. Multitenant execution cannot traverse private endpoints, and the documented consequence is silent failure with an empty index.
  • C. Trigger type has no bearing on which network path the indexer uses; an on-demand run from the multitenant environment fails the same way.
  • D. Max failed items governs tolerance of per-document errors, which is not what is happening when no document can be reached at all.
Question 4Plan and manage an Azure AI solution

A team wants to keep using API keys for a Foundry resource for one more quarter. Which two capabilities will not work at all under key authentication and therefore force the move to Microsoft Entra ID? Each correct answer presents part of the solution.

Choose 2.

  1. A.

    Evaluations

  2. B.

    Chat completions and embeddings inference

  3. C.

    Network isolation with Private Link

  4. D.

    Content safety analyze calls

  5. E.

    The Agents service

Show answer

Answer: A, E

The feature support matrix marks the Agents service and Evaluations as unsupported under API keys; basic inference, content safety calls and Private Link all work either way.

  • A. The matrix marks Evaluations as unsupported with API keys and instructs you to use Entra ID for evaluation runs.
  • B. Basic model inference such as chat and embeddings is listed as fully supported under both authentication methods.
  • C. Private Link is a network control that works with either method; Entra ID only adds conditional access on top of it.
  • D. Content safety analyze calls are supported with either method, with RBAC recommended to limit high-risk operations.
  • E. The matrix marks the Agents service as unsupported with API keys and directs you to Entra ID for managed identity tool access.
Question 5Plan and manage an Azure AI solution

A subscription was approved for provisioned throughput quota in a region last week and none of it has been consumed. Creating the provisioned deployment there fails today. What is the most likely cause?

  1. A.

    The region does not currently have enough deployable capacity for the requested model and PTU count, which is a separate constraint from quota

  2. B.

    A reservation must be purchased before a provisioned deployment can be created

  3. C.

    Provisioned quota can only be consumed by a deployment created through the REST API or a Bicep template, because the portal deployment experience creates standard deployments only

  4. D.

    The approved quota expires if it is not consumed within seven days of approval

Show answer

Answer: A

Quota is a policy limit; capacity is the PTUs actually available in the region, and having quota does not guarantee capacity exists.

  • A. Quota and capacity are distinct, and the docs state a deployment fails when regional capacity is insufficient even with quota approved.
  • B. Reservations are decoupled from deployments and are purchased after capacity is confirmed; they are a discount, not a prerequisite.
  • C. The portal deployment experience is the documented way to check capacity and create a provisioned deployment, so no API or template is required.
  • D. No expiry of this kind is documented; unconsumed quota simply remains as a ceiling on what you can deploy.
Question 6Plan and manage an Azure AI solution

A refunds agent may call a payment tool. Policy states that any refund above 500 US dollars must be authorised by a human before money moves, and that the authorisation must be auditable. The agent otherwise runs unattended. How should you enforce the policy?

  1. A.

    Require an explicit human approval step in the tool invocation path for refunds above the threshold, and record the approver and decision with the run

  2. B.

    Add refund-related terms to the content filter blocklist so that large refunds are blocked

  3. C.

    Add a sentence to the agent instructions telling it to ask the user for explicit confirmation before it issues any refund above the 500 dollar threshold

  4. D.

    Lower the temperature of the model so that the agent behaves deterministically when handling refunds

Show answer

Answer: A

An enforced approval step in the tool path is the only option that can actually stop the call and produce an audit record of who authorised it.

  • A. An enforced approval gate blocks execution until a recorded human decision exists, satisfying prevention and audit.
  • B. A text blocklist cannot evaluate a numeric argument on a tool call and would block ordinary refund conversations.
  • C. Instructions are advisory and can be argued away, and asking the customer is not an authorisation by the business.
  • D. Lower temperature makes wording more predictable but does not restrict which tools the agent may call.
Question 7Plan and manage an Azure AI solution

Fabrikam is grounding an assistant in 90,000 maintenance procedures. Technicians describe symptoms in their own words, but they also paste exact part codes such as FX-4471-B that must match literally. Recall must stay high for both query styles, and the top five passages sent to the model must be ordered by true relevance. Which retrieval configuration should you use?

  1. A.

    Hybrid retrieval that fuses vector and keyword results, followed by the semantic ranker

  2. B.

    Fine-tune the chat model on all 90,000 maintenance procedures and query it directly

  3. C.

    Keyword retrieval only, with a synonym map for common symptom words

  4. D.

    Vector-only retrieval with a larger number of nearest neighbours

Show answer

Answer: A

Hybrid retrieval covers paraphrases and literal codes at once, and the semantic ranker reorders the fused list so the best five passages reach the model.

  • A. Hybrid retrieval handles both paraphrases and exact codes, and semantic ranking fixes the ordering of the fused list.
  • B. Fine-tuning adapts style and format, not a factual corpus, and it cannot cite the procedure that produced an answer.
  • C. Keyword-only matching fails on paraphrased symptoms, and a synonym map cannot enumerate free-form language.
  • D. Vector search represents rare alphanumeric codes poorly, so exact part codes stay missed however many neighbours are returned.
Question 8Plan and manage an Azure AI solution

Before a public launch, you must produce evidence of how a grounded assistant behaves when it is attacked: when a user tries to elicit harmful content, and when a retrieved document contains hidden instructions. The evidence must be reproducible for the release record. Which two actions should you perform? Each correct answer presents part of the solution.

Choose 2.

  1. A.

    Increase the severity threshold of every content filter category to high before launch

  2. B.

    Ask the support team to try to break the assistant for one day and summarise what they found

  3. C.

    Measure average response latency under load with a performance test

  4. D.

    Run a safety evaluation that uses an adversarial simulator to generate attack prompts and scores the responses with the harm evaluators

  5. E.

    Run the indirect attack evaluator over a dataset in which retrieved context contains injected instructions

  6. F.

    Run the fluency and coherence evaluators over the standard question set

Show answer

Answer: D, E

An adversarial simulator with harm evaluators covers direct attacks, and the indirect attack evaluator covers instructions hidden in retrieved content; both produce reproducible scored datasets.

  • A. Raising thresholds changes behaviour without generating any evidence, and may block legitimate content.
  • B. An informal bug bash yields anecdotes rather than a reproducible, comparable metric for the release record.
  • C. Latency is a performance attribute and says nothing about behaviour under attack.
  • D. Adversarial simulation with harm evaluators produces reproducible defect rates for direct attacks.
  • E. The indirect attack evaluator is the specific measure for instructions injected through retrieved context.
  • F. Fluency and coherence measure writing quality on benign inputs, not resistance to attack.
Question 9Plan and manage an Azure AI solution

Search latency for a grounding index rises sharply every weekday between 02:00 and 03:00, and throttled queries appear in the same window. Query volume in that window is low. What is the most likely explanation?

  1. A.

    A scheduled indexer run is consuming the same replicas and partitions that serve queries, so indexing and querying compete for one pool of resources

  2. B.

    Semantic ranking is applied only outside business hours, adding a second ranking pass to every query

  3. C.

    The service drops to a reduced tier outside business hours, lowering the resources available to queries

  4. D.

    Metrics are aggregated hourly overnight, which inflates the reported latency for that window

Show answer

Answer: A

Indexing and querying are served by the same replicas and partitions, so a heavy indexer run degrades query latency and raises throttling.

  • A. Query and indexing requests are handled by the same replicas and partitions, which is the documented cause of this pattern.
  • B. Semantic ranking is a per-query option set by the caller, not something the service applies on a time-of-day basis.
  • C. A search service does not change tier on a schedule; replicas and partitions stay as provisioned until you change them.
  • D. The one-minute time grain is fixed within the system and does not switch to hourly aggregation overnight.
Question 10Plan and manage an Azure AI solution

A German insurer must be able to prove that every inference request for its claims assistant is processed inside the single Azure region named in its regulatory filing. Traffic is moderate and bursty. Which deployment option satisfies the filing?

  1. A.

    A standard deployment created on a resource in that region

  2. B.

    A data zone deployment, which routes within a group of regions

  3. C.

    A global batch deployment with a regional storage account for inputs and outputs

  4. D.

    A global standard deployment, because Microsoft Entra ID pins the tenant to a region

Show answer

Answer: A

Only a regional standard deployment keeps inference processing inside one named region, which is what the filing requires.

  • A. A standard deployment on a resource in that region processes inference in that region only.
  • B. A data zone constrains routing to a group of regions, which is broader than the single region named in the filing.
  • C. Batch is asynchronous and the global scope still breaks the single-region processing guarantee.
  • D. Global routing sends requests to available capacity anywhere, and Entra ID tenancy does not constrain processing location.

Keep going with 569 more AI-103 questions

Free papers every day, in the real exam formats, with progress by exam domain. Unlock every paper and timed mock exam when you are ready.

Practise freeSee all AI-103 papers
AI-103 sample questions with answers (10 free) · CertifyAIx