AI-500 Sample Questions Answers

The workload mixes simple prompts, reasoning-heavy tasks, and tool-calling workflows, so a single premium model is over-provisioned for many requests. Microsoft Foundry ' s model router evaluates request complexity and routes each request to an appropriate model from a configured pool. Simple work can use lower-cost, lower-latency models, while complex reasoning can still be assigned to a more capable model. Structured outputs constrain response format but do not reduce model capability according to request complexity. Prompt Optimizer can improve prompt quality but does not perform per-request model selection, and choosing another flagship model would preserve the same all-requests-use-premium pattern. Therefore A directly addresses the cost and latency variability by matching model capacity to workload complexity. A robust evaluation program separates process metrics from final-response metrics. The selected answer measures the layer where the stated failure actually occurs, which is essential for deciding whether to change retrieval, orchestration, prompt behavior, or the final generator.

Official Microsoft reference: Microsoft Foundry - Model router

============================================================

The Scheduling agent ' s MCP server fails transiently during peak load. Microsoft Azure reliability guidance recommends retries with exponential backoff for transient faults so that callers do not immediately repeat requests at the same rate and worsen a temporarily overloaded dependency. Immediate retries can create a retry storm, especially when many agent requests encounter the same service condition. Routing the tool call through a different agent does not remove the underlying MCP dependency and would only add coupling. A well-designed retry policy should normally include a bounded retry count, increasing delay, jitter where appropriate, and respect for server-provided retry guidance when available. The scenario asks which design element directly addresses the timeouts, and exponential backoff is the established resilience pattern for transient service saturation. Therefore A is the correct choice. At implementation time, the same rule should be expressed through the framework or service configuration rather than left only as a natural-language convention. That makes the behavior repeatable across runs, easier to test, and less sensitive to model variability.

Official Microsoft reference: Azure Well-Architected Framework - Handle transient faults

============================================================

Log the start/completion of each specialist run and inspect the final output with Agent run middleware; record each customer-refund-tool call, including function name and arguments, with Function calling middleware.

The two logging requirements occur at different lifecycle boundaries. Agent run middleware surrounds an agent invocation, so it is the appropriate place to capture run start, run completion, exceptions, and the final agent result. Function calling middleware surrounds tool/function execution and can inspect the selected function, arguments, result, and failures. That makes it the correct boundary for an audit record of each customer-refund-tool invocation. Foundry tracing can provide broader distributed observability, but the question asks for reusable Microsoft Agent Framework middleware at the exact execution points. A knowledge store or memory store does not provide execution interception. Separating the two concerns also supports a cleaner audit model: agent-level middleware records specialist behavior, while function-level middleware records tool use. This aligns with Microsoft ' s middleware model, where cross-cutting concerns such as logging, validation, and exception handling can be implemented once and applied consistently rather than duplicated inside every agent or tool.

Official Microsoft reference: Microsoft Agent Framework - Defining middleware

============================================================

Support agent: Document Retrieval; Policy agent: Document Retrieval.

Both failures are retrieval failures and should therefore be diagnosed with the Document Retrieval evaluator. The dataset includes expected source IDs and ranked retrieved chunks, which provides the retrieval ground truth required by that evaluator. For the support agent, the expected source appears too low in the ranking after unrelated chunks. For the policy agent, the required exception-table source is missing entirely. Groundedness would evaluate whether the final response is supported by the context it actually received; it could therefore pass even when the retrieval stage failed to fetch a required source. Microsoft Foundry ' s Document Retrieval evaluator compares retrieved documents against labeled ground truth and reports ranking/search metrics such as NDCG and Fidelity. The corrected answer is Document Retrieval for both agents. For operational use, the measurement should be captured in a repeatable dataset, trace, or automated gate so that the same criterion can be compared across versions. That is more useful than a one-off manual observation and makes regressions visible before they become production incidents.

Official Microsoft reference: Microsoft Foundry - RAG evaluators

============================================================

Separate managed identities for each agent and environment remove the need to store application secrets and create independent authorization boundaries. Assigning Azure roles at the resource level further limits each identity to only the Storage resource it requires. This sharply reduces lateral movement compared with a shared application principal or subscription-wide role. Microsoft Foundry and Azure identity guidance consistently recommend identity-based authentication, distinct identities when permissions differ, and the narrowest practical RBAC scope. In current Foundry deployments, the exact identity object may be represented through Microsoft Entra agent identity or a federated managed identity relationship, but the architectural principle in the option is correct. Therefore the solution meets both stated goals and the answer is A, Yes. From a security and governance perspective, the control should be enforced at the narrowest platform boundary that can deterministically block or constrain the action. Relying only on prompt text is weaker because the model can still be induced to behave unexpectedly.

Official Microsoft reference: Microsoft Foundry agent identity

============================================================

GitHub issues are the authoritative source for current requirements, and those requirements can change while a long-running workflow is still executing. Each handoff should therefore reconstruct context from the current issue state and discard memory that has been invalidated by newer requirements. Keeping an accumulated summary allows obsolete criteria to remain present and also causes the prompt to grow until older content is truncated. Persisting the transcript in Cosmos DB preserves history but does not make that history current. Giving subagents a GitHub lookup tool while continuing to inject the stale summary can expose the model to conflicting versions of the same requirement. Microsoft Agent Framework context providers are intended to inject current external context at invocation time, making C the approach that simultaneously preserves freshness and bounds context growth. In production, add telemetry and regression tests around this behavior so changes to prompts, models, tools, or orchestration do not silently alter the intended contract. The selected approach is the one that best matches the platform ' s native execution semantics.

Official Microsoft reference: Microsoft Agent Framework - Context providers

============================================================

The requirements ask for behavior that applies to every future conversation, improves routing for representative compound inputs, and standardizes final output with minimal application-code change. Few-shot instruction examples satisfy all three by demonstrating both the desired routing decision and the expected schema-compliant response for representative cases. Repository-wide constraints list rules but do not demonstrate how ambiguous compound requests should be handled. Per-request prompt cues are not durable across future conversations and would require application logic to inject them repeatedly. System role instructions define domains and objectives but provide less behavioral specificity than examples. Microsoft AI-500 prompt-engineering objectives explicitly include examples and dynamic prompt techniques for shaping complex agent behavior. Therefore C is the strongest design. The implementation should also preserve clear inputs and outputs around this step so that later agents receive only the information they require. This improves debuggability and keeps token, permission, and state growth under control as the workflow becomes more complex.

Official Microsoft reference: AI-500 Study Guide - advanced prompt engineering

============================================================

InvoiceValidationAgent and PaymentApprovalAgent: One blueprint and one agent identity per agent role; VendorNegotiationAgent: An independent blueprint, one agent identity, and one agent user account.

Invoice validation and payment approval are distinct finance roles with different ERP permissions, so each should have its own logical agent identity for least-privilege access and audit attribution. They can remain within the same finance trust boundary while using separate identities. The vendor-negotiation agent operates across an external supplier boundary and should therefore use an independent blueprint/trust boundary. Its dedicated Exchange Online mailbox introduces an additional Microsoft 365 requirement: Microsoft Entra Agent ID supports associating an agent identity with an agent user account when the agent needs resources that require a user object, such as Exchange mailboxes or Teams. Sharing a single identity across all roles would blur audit ownership and expand compromise impact. The answer therefore matches Microsoft ' s current agent-identity separation model. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Entra Agent ID - plan agent identity architecture

============================================================

Runtime instrumentation: OpenTelemetry distributed tracing with correlation IDs; Post-deployment assessment: A scheduled evaluation that uses test datasets.

Distributed tracing is the correct runtime mechanism because the objective is to reconstruct a user interaction across agents, models, tools, functions, and API boundaries without relying on verbose log text. Microsoft Foundry uses OpenTelemetry-compatible traces and Application Insights so related spans can be correlated into one execution path. Correlation identifiers allow operators to isolate one conversation and inspect where latency, failures, or unexpected behavior originated. The second requirement is different: it asks for recurring, comparable measurements of deployed response quality and safety. Scheduled evaluations against stable test datasets provide that longitudinal benchmark and are more appropriate than ad hoc tracing or infrastructure-only dashboards. Together, OpenTelemetry answers “what happened in this run?” while scheduled evaluation answers “is behavior getting better or worse over time?” The selected pair therefore covers both operational diagnosis and quality regression monitoring. For operational use, the measurement should be captured in a repeatable dataset, trace, or automated gate so that the same criterion can be compared across versions. That is more useful than a one-off manual observation and makes regressions visible before they become production incidents.

Official Microsoft reference: Microsoft Foundry observability concepts

============================================================

The malicious text is contained in an uploaded email rather than being typed directly as the user ' s prompt. Microsoft classifies malicious instructions embedded in external or retrieved content as an indirect prompt-injection attack. Prompt Shields for documents is designed to detect those attacks in document content before the content can steer the model away from its system instructions. Prompt Shields for user prompts addresses direct attacks originating in the user ' s prompt and therefore targets the wrong attack surface here. Groundedness evaluates whether a response is supported by context; it does not prevent an injected instruction from changing agent behavior. Task Adherence can assess whether an agent follows its task constraints, but it is not the primary control for document-borne prompt injection. Because the source of the attack is the uploaded email, the document-oriented Prompt Shields control is the technically aligned guardrail. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points and indirect attacks

============================================================

The business rule requires human review for refunds above the stated threshold before payment can continue. A workflow therefore needs a user or operator interaction point that pauses progress and obtains an explicit response. In the workflow options provided, Ask a question is the node that introduces that human interaction. Invoke agent simply delegates work to another agent; it does not itself guarantee human approval. Deliver a message sends information without collecting a decision, and Go to changes control flow without obtaining authorization. Microsoft Agent Framework and Foundry workflow guidance treat human-in-the-loop approval as a first-class orchestration requirement for consequential actions. The decisive requirement is not just to notify a reviewer, but to stop automated progression until the reviewer supplies a decision. Therefore the workflow must include an interactive question/approval step before the refund-processing action can proceed for amounts over the threshold. The implementation should also preserve clear inputs and outputs around this step so that later agents receive only the information they require. This improves debuggability and keeps token, permission, and state growth under control as the workflow becomes more complex.

Official Microsoft reference: Microsoft Agent Framework - Human-in-the-loop workflows

============================================================