AI-103 Certification Practice Question #20

Question

You have a Microsoft Foundry project that contains an agent.
The agent uses tools to retrieve internal content and call external APIs. The agent is configured to let the model decide when to call the tools.
You need to publish the agent for a compliance workflow. The solution must meet the following requirements:
Each workflow run must include a retrieval step before generating a response.
Tool calls must authenticate by using the published agent’s own identity.
Tool access must use an identity isolated from other project resources.
Tool access must use support audit tracing.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Accepted Answer

Two requirements drive the two selections. "Each workflow run must include a retrieval step before generating a response" requires deterministic tool invocation, so `tool_choice` must be `required` (not `auto`, which the model can skip, nor `none`, which disables tools). The remaining requirements — authenticate using the published agent's *own* identity, an identity *isolated* from other project resources, and support for *audit* tracing — match a published agent's distinct agent identity: after publishing, each agent gets a unique Entra identity that provides isolation, granular least-privilege RBAC, and separate auditing, whereas the shared project identity is explicitly called out as a broader blast radius and storing keys in prompts is an anti-pattern. The image's third dropdown is cut off in the captured PNG (the question lists four requirements but only two selectable rows are visible), and there are no community votes, so confidence is held in the notable-split band; the visible two selections are nonetheless strongly grounded in MS Learn.

More AI-103 practice questions