View Full Microsoft AB-100 Exam Dumps and Practice Test Dumps.

 

Question 241

What is the main purpose of an API gateway in an AI solution?

1. Generate model responses
2. Manage and control access to backend APIs
3. Store training datasets
4. Create vector embeddings

Correct Answer: 2

Explanation

An API gateway provides a controlled entry point between applications or agents and backend services. It can support authentication, authorization, routing, rate limiting, logging, and other policies. In an AI architecture, an API gateway can help prevent agents from directly accessing numerous services without centralized controls. It can also provide consistent monitoring and traffic management. The gateway does not replace the underlying business APIs or AI models. Instead, it provides an additional management and security layer around service access.

Question 242

Which practice helps protect an agent from prompt injection?

1. Trust every retrieved instruction
2. Remove authentication
3. Separate trusted instructions from untrusted content
4. Increase the context window

Correct Answer: 3

Explanation

Separating trusted instructions from untrusted content helps reduce the risk that external text will manipulate an agent’s behavior. Retrieved documents, user inputs, web pages, and tool outputs may contain instructions that should be treated as data rather than commands. The agent should have clearly defined system instructions and boundaries for what external content can influence. Additional defenses can include input filtering, prompt shields, tool authorization, and adversarial testing. No single control completely eliminates prompt-injection risk.

Question 243

A company needs an agent to update customer records. What should happen before the update is executed?

1. Validate the request and authorize the action
2. Disable audit logging
3. Give the agent administrator access
4. Skip confirmation checks

Correct Answer: 1

Explanation

Before an agent performs a customer-record update, the system should validate the requested operation and confirm that the agent or user has authorization to perform it. Validation can check required fields, business rules, and whether the requested change is within the agent’s scope. Authorization ensures that the identity making the request has the necessary permissions. Audit logging should also record important actions. These controls reduce the risk of unauthorized or incorrect modifications to business data.

Question 244

Which approach is most useful when an agent must handle a sudden increase in workload?

1. Remove all request limits
2. Use scalable infrastructure and workload queues
3. Increase every prompt size
4. Disable monitoring

Correct Answer: 2

Explanation

Scalable infrastructure and workload queues can help an AI system handle temporary increases in demand. Queues allow incoming work to be buffered instead of overwhelming downstream services immediately. Scalable compute and service capacity can then process requests as resources become available. Architects should also consider rate limits, concurrency, timeout settings, and monitoring. Simply removing limits can overload dependent services. A resilient architecture balances throughput, latency, availability, and cost while maintaining predictable behavior during workload spikes.

Question 245

What does data minimization mean in an AI solution?

1. Collecting and retaining only data necessary for the intended purpose
2. Sending all available data to the model
3. Keeping every user interaction forever
4. Removing all security controls

Correct Answer: 1

Explanation

Data minimization means collecting, processing, and retaining only the information necessary for a defined business purpose. In AI systems, unnecessary data can increase privacy, security, compliance, and cost risks. For example, an agent processing a support request may not need a customer’s complete historical profile. Minimizing the information provided to prompts, tools, logs, and storage systems can reduce exposure. Data minimization should be considered throughout the solution lifecycle, including collection, processing, monitoring, retention, and deletion.

Question 246

An agent needs to retrieve only documents belonging to the user’s department. Which feature is most important?

1. Larger embeddings
2. Access-aware filtering
3. Longer prompts
4. Random retrieval

Correct Answer: 2

Explanation

Access-aware filtering ensures that retrieval results respect the user’s existing authorization boundaries. Before returning documents to the model, the retrieval system should apply appropriate identity, department, role, or record-level permissions. This is important because grounding an answer with unauthorized information can create a data exposure even if the final response does not explicitly reveal the source. Retrieval security should therefore be designed alongside indexing and search. Larger models or prompts do not compensate for missing authorization controls.

Question 247

Which component can provide current information from a transactional business system to an agent?

1. Static system prompt
2. Model fine-tuning
3. Tool or connector
4. Tokenizer

Correct Answer: 3

Explanation

A tool or connector can allow an agent to retrieve current information directly from a transactional business system. For example, an order-management connector could retrieve the latest order status instead of relying on information stored in a model’s training data or static prompt. The integration should use appropriate authentication, authorization, input validation, and error handling. This approach is particularly useful for information that changes frequently. Static prompts and model training are not suitable substitutes for accessing live transactional data.

Question 248

Why should AI agents have a clearly defined scope?

1. To limit unnecessary actions and reduce risk
2. To increase unrelated data access
3. To eliminate testing
4. To prevent all user interaction

Correct Answer: 1

Explanation

A clearly defined agent scope establishes what tasks, data, systems, and actions the agent is permitted to handle. Narrow scope reduces unnecessary permissions and makes the system easier to test, monitor, and govern. It also provides clear boundaries for handling requests that fall outside the agent’s responsibilities. When an agent encounters an out-of-scope request, it can provide a suitable response or escalate the matter. Clearly defined scope supports least privilege, predictable behavior, and safer automation.

Question 249

What is a key purpose of a human-in-the-loop workflow?

1. Eliminate all automation
2. Allow human review when decisions or actions require oversight
3. Increase model token usage
4. Replace authentication

Correct Answer: 2

Explanation

A human-in-the-loop workflow introduces human review at appropriate points in an automated process. This is useful when an action has significant business, financial, legal, safety, or customer impact. For example, an agent may prepare a refund recommendation while requiring an authorized employee to approve the final transaction. Human oversight does not mean every automated step must require manual intervention. Instead, review points should be designed around risk and business requirements, allowing routine tasks to remain automated while higher-impact actions receive additional oversight.

Question 250

Which metric is useful for measuring an agent’s response speed?

1. Latency
2. Accuracy category
3. Data residency
4. Permission count

Correct Answer: 1

Explanation

Latency measures the time required for a system to respond or complete an operation. For AI agents, latency can include model processing, retrieval, tool calls, network communication, and orchestration overhead. Monitoring latency helps teams determine whether an application meets user-experience requirements. Average latency alone may not provide a complete picture, so teams can also examine percentile measurements and identify slow components. Performance improvements may involve model selection, caching, parallel execution, retrieval optimization, or reducing unnecessary tool calls.

Question 251

An agent must perform two independent data lookups before generating a response. Which execution strategy may reduce waiting time?

1. Sequential execution only
2. Parallel execution
3. Repeated fine-tuning
4. Manual data entry

Correct Answer: 2

Explanation

Parallel execution allows independent operations to run at the same time rather than waiting for one operation to finish before starting another. If two data lookups have no dependency on each other, running them concurrently can reduce overall workflow latency. The architecture must still consider service limits, failure handling, and resource consumption. Operations that depend on earlier results should remain sequential. Proper orchestration determines which tasks can safely execute in parallel and which require an ordered sequence.

Question 252

What should an AI evaluation dataset contain?

1. Only successful examples
2. Random data unrelated to production
3. Representative inputs and expected evaluation criteria
4. Only the largest possible prompts

Correct Answer: 3

Explanation

An evaluation dataset should represent the types of requests, users, conditions, and edge cases the AI solution is expected to handle. It can include normal scenarios, difficult questions, ambiguous requests, safety-sensitive cases, and known failure patterns. Evaluation criteria should define what constitutes an acceptable result, such as accuracy, groundedness, relevance, or appropriate refusal. Using only successful examples can hide important weaknesses. Representative evaluation datasets provide a repeatable way to compare versions and detect regressions after changes.

Question 253

What is the purpose of reranking retrieved documents?

1. To prioritize the most relevant retrieved results
2. To remove authentication
3. To increase API permissions
4. To replace the language model

Correct Answer: 1

Explanation

Reranking is used after an initial retrieval stage to reorder candidate results according to their relevance to the user’s query. A retrieval system may return several potentially useful documents, but not all have equal importance. Reranking can place the strongest evidence near the top so that the model receives more relevant context. This can improve answer quality and reduce unnecessary context. Reranking should complement effective indexing, query processing, access controls, and retrieval rather than replace those components.

Question 254

A knowledge base contains outdated policy documents. What should the AI team prioritize?

1. Increasing model temperature
2. Updating and removing outdated knowledge sources
3. Adding unrelated documents
4. Disabling evaluation

Correct Answer: 2

Explanation

Outdated knowledge can cause an agent to provide incorrect or obsolete answers even when the retrieval system functions correctly. The team should establish ownership and processes for reviewing, updating, replacing, or removing documents. Metadata such as effective dates and document status can also help retrieval systems prioritize current information. Knowledge freshness should be included in ongoing monitoring and evaluation. Simply changing model parameters does not correct stale source content. Maintaining trusted knowledge sources is essential for reliable grounded responses.

Question 255

Which capability helps an agent continue operating when its primary model becomes temporarily unavailable?

1. Model fallback
2. Prompt deletion
3. Data duplication without controls
4. Context expansion

Correct Answer: 1

Explanation

Model fallback allows an application to use an alternative model or processing path when the primary model is unavailable or fails defined requirements. A fallback strategy can improve availability and resilience, but the alternative model should be evaluated for acceptable quality, latency, cost, and supported capabilities. The application should also define when fallback occurs and how failures are logged. Fallback should not silently bypass security or business rules. All models and workflows involved should remain within approved governance boundaries.

Question 256

What is the purpose of a token budget in an AI application?

1. To control and manage token consumption
2. To assign user permissions
3. To create database indexes
4. To authenticate external APIs

Correct Answer: 1

Explanation

A token budget establishes limits or expectations for how much model input and output an application can consume. Managing token usage can help control costs, maintain predictable performance, and avoid exceeding model context limits. Architects can reduce unnecessary token consumption through concise prompts, targeted retrieval, summarization, caching, and appropriate model selection. Token budgets should be monitored against actual workloads because usage patterns can change. They are one part of broader cost governance and do not replace security or authorization controls.

Question 257

An agent needs to call a payment API. Which security principle should guide the permissions assigned to the agent?

1. Maximum privilege
2. Least privilege
3. Anonymous access
4. Shared administrator access

Correct Answer: 2

Explanation

Least privilege means granting the agent only the permissions required to perform its approved responsibilities. A payment-related agent should not automatically receive broad administrative access simply because it needs to perform a specific transaction. Permissions should be narrowly scoped to the required API operations and resources. Authentication, authorization, approval workflows, transaction limits, and audit logging can provide additional safeguards. Least privilege reduces the potential impact if the agent, its credentials, or an integrated component is misused or compromised.

Question 258

Which practice is most useful for detecting unexpected changes in an AI system after deployment?

1. Post-deployment monitoring
2. Removing evaluation data
3. Disabling telemetry
4. Increasing all permissions

Correct Answer: 1

Explanation

Post-deployment monitoring helps teams detect changes in system behavior after an AI solution is released. Useful signals can include response quality, latency, error rates, tool failures, usage patterns, costs, safety incidents, and other business metrics. Monitoring can reveal issues that were not visible during controlled testing, including changes in user behavior or underlying data. Teams should define thresholds and response procedures for important signals. Monitoring therefore supports ongoing reliability, governance, and maintenance throughout the agent lifecycle.

Question 259

When should a major prompt or model change be evaluated?

1. Only after users report problems
2. Before production deployment
3. After permanently deleting the previous version
4. Only once during initial development

Correct Answer: 2

Explanation

Major prompt or model changes should be evaluated before production deployment to determine whether they improve or negatively affect system behavior. Testing can compare the new version against an established baseline using representative evaluation datasets and important business scenarios. Teams should assess accuracy, groundedness, safety, latency, cost, and other relevant requirements. Maintaining previous versions also supports rollback if necessary. Treating prompts and models as controlled application components helps prevent untested changes from unexpectedly affecting production users.

Question 260

What is an important consideration when deciding between fine-tuning and RAG?

1. Whether the requirement is primarily behavior adaptation or access to changing knowledge
2. Whether the application has a graphical interface
3. Whether users prefer shorter passwords
4. Whether the database uses alphabetical names

Correct Answer: 4

Explanation

The choice between fine-tuning and retrieval-augmented generation should be based on the actual business requirement. Fine-tuning can be useful for adapting model behavior, style, or task performance using appropriate training examples. RAG is generally useful when the model needs access to external knowledge that may change and should be retrieved at runtime. The two approaches can also be combined. Teams should evaluate accuracy, maintenance effort, data requirements, update frequency, cost, and governance before selecting an approach.