Free Microsoft Certified: Azure AI Apps and Agents Developer Associate (AI-103) Sample Questions

Correct answer: A — Serverless deployment billed per token consumed through a hosted API

• A. Correct. Serverless deployment bills per token processed through a Microsoft-hosted API, so there's no idle virtual machine cost during low or unpredictable traffic.
• B. Incorrect. Managed compute bills for the virtual machine core hours behind the deployment regardless of whether traffic is flowing, which wastes cost when idle.
• C. Incorrect. A reserved GPU cluster running continuously incurs cost whether or not requests arrive, the opposite of what this cost-sensitive startup needs.
• D. Incorrect. Fine-tuning trains a model on data ahead of time; it isn't a per-request serving mechanism and wouldn't run for every incoming request.

Correct answer: A — Web Search, which retrieves current public information and returns citations

• A. Correct. Web Search retrieves real-time public information and returns answers with inline citations, matching the need for current flight-delay news with sourcing.
• B. Incorrect. File Search only searches documents the developer already uploaded, so it can't surface breaking news from the public web.
• C. Incorrect. Code Interpreter runs sandboxed Python without internet access, so it cannot fetch live news.
• D. Incorrect. The Azure AI Search tool grounds responses in an existing internal index, not live public news.

Correct answers: A, B — The workload runs on a resource-constrained edge device with tight latency budgets; Inference cost per request must stay as low as possible at high request volume

• A. Correct. SLMs are designed for lightweight inference, making them well suited to resource-constrained, latency-sensitive edge deployments.
• B. Correct. SLMs typically cost less per request than large models, which matters when request volume is high and margins are tight.
• C. Incorrect. Deep multi-step reasoning across long, complex documents generally favors a larger, more capable LLM over a smaller model.
• D. Incorrect. Long-form creative narrative generation benefits from an LLM's larger capacity and stronger language modeling depth.
• E. Incorrect. Broad, nuanced multilingual coverage typically favors larger models trained on more diverse data rather than a compact SLM.

Correct answers: B, D, F — Global Provisioned; Data Zone Provisioned; Regional Provisioned

• A. Global Standard is a pay-per-token deployment category, not a provisioned throughput type, since it does not reserve dedicated PTU capacity.
• B. Global Provisioned routes traffic across Azure regions globally while reserving dedicated PTU capacity, making it one of the three provisioned throughput deployment types.
• C. Managed compute is a separate deployment type for hosting open-source models on dedicated GPUs, billed hourly per accelerator rather than per PTU.
• D. Data Zone Provisioned keeps reserved-capacity traffic within a geographic zone such as the US or EU, making it one of the three provisioned throughput deployment types.
• E. Data Zone Batch is an asynchronous, discounted deployment category, not a provisioned throughput type, since it does not reserve dedicated PTU capacity.
• F. Regional Provisioned pins reserved PTU capacity to a single Azure region, making it one of the three provisioned throughput deployment types.

Correct answers: B, D — Contributor; Foundry Owner

• A. Global Administrator is a Microsoft Entra tenant-wide role unrelated to provisioning Azure resources and is far broader than what the pipeline's service principal needs.
• B. The Azure Contributor role grants the ability to create and manage Azure resources such as the Foundry project's supporting infrastructure, which the pipeline needs during provisioning.
• C. Cognitive Services User grants read-only data-plane access for calling deployments; it does not grant the control-plane permissions needed to provision infrastructure.
• D. Foundry Owner grants the Foundry-specific control-plane permissions the pipeline needs alongside Contributor to successfully provision Foundry resources.
• E. Foundry Project Manager provides project-level management access but is not the role documented for resolving provisioning authorization failures.
• F. Reader grants only read access to resources and cannot create or update the infrastructure that azd provision needs to establish.

Correct answer: A — Enable Search Traffic Analytics by sending a searchId from the application to Application Insights whenever a user clicks a result

• A. Azure AI Search does not natively know whether a user found a result useful, so Search Traffic Analytics captures this by correlating a searchId with subsequent click events sent to Application Insights, directly measuring real-world click-through relevance.
• B. Adding replicas increases query throughput and availability but has no ability to capture whether users actually clicked on or were satisfied with the returned results.
• C. Re-running groundedness against a fixed test dataset measures how well responses are supported by source documents in a controlled setting; it does not capture live user click behavior in production.
• D. Prompt Shields detect jailbreak or injection attempts in user input and are a safety control, not a mechanism for measuring whether users found search results relevant.

Correct answer: A — Standard

• A. Spillover is designed to route overflow traffic to a paired Standard (pay-as-you-go) deployment automatically, so bursts beyond reserved PTU capacity are still served without custom application logic.
• B. Batch deployments are designed for asynchronous, large-volume offline processing with relaxed latency requirements, not for absorbing real-time overflow from a PTU deployment.
• C. Fine-tuned refers to a model that has been further trained on custom data; it describes a model customization state, not a deployment type that receives spillover traffic.

Correct answer: A — Medium (4-5)

• A. Medium (4-5) is correct because the documented definition for this severity band includes direct insults, negative comments, and slurs targeting social groups based on their characteristics.
• B. Very Low (0-1) is incorrect because that band describes neutral or informative references to hate-related terms, not direct insults or slurs.
• C. High (6-7) is incorrect because that band is reserved for content with hostile, violent, or criminal intent such as inciting hate crimes, which is more severe than direct insults alone.

Correct answer: A — provenance metadata

• A. Provenance metadata is correct because auditing through provenance metadata means recording origin details, such as data source and model version, alongside each response so it can be traced later.
• B. A temperature parameter is incorrect because it controls generation randomness at inference time and carries no information about a response's origin or source for auditing.
• C. A vector embedding is incorrect because it is a numeric representation used for retrieval and similarity search, not a record of a response's audit provenance.

Correct answer: A — 0 to 7

• A. 0 to 7 is correct because Azure AI Content Safety harm category severity levels (Very Low, Low, Medium, High) map onto a 0-7 numeric scale.
• B. 1 to 5 is incorrect; this is not the scale Content Safety publishes for its harm category severity levels.
• C. 0 to 10 is incorrect; Content Safety does not use a ten-point severity scale for its harm categories.
• D. 1 to 3 is incorrect and too coarse compared to the documented four-band, 0-7 severity scale.

Correct answer: A — The Agent-to-Agent (A2A) protocol

• A. The A2A protocol is the Foundry-supported mechanism specifically designed for agent-to-agent communication and handoff.
• B. OpenAPI 3.1 describes REST API contracts for custom tools, not agent-to-agent conversation handoff.
• C. MCP exposes tools to agents through a standard server interface, but it is not the protocol used for agent-to-agent handoff.
• D. The Responses API is the single model and tools entry point for an individual agent, not a cross-agent handoff protocol.

Correct answers: A, B, C — Hateful and unfair content; Self-harm-related content; Sexual content

• A. Default content safety filtering for serverless language model deployments screens for hate and unfairness.
• B. Self-harm-related content is one of the harmful categories covered by the default filter set.
• C. Sexual content is also included among the default harmful-content categories screened by this filtering.
• D. Weak cryptographic algorithms are a code vulnerability finding evaluated separately, not a default text content-safety category.
• E. Stack trace exposure is a code vulnerability risk evaluated separately, not part of default content moderation filtering.
• F. Path injection is a code vulnerability subclass, unrelated to the default text content-safety filter categories.

Correct answers: A, B, D — Break the task into smaller steps, such as extracting claims before generating queries; Use clear syntax, such as separators and uppercase section headers, to distinguish each stage; Use an affordance like search, pausing generation to insert retrieved results back into the prompt

• A. Breaking a complex task into smaller steps, like separating extraction from query generation, improves accuracy on multistep pipelines.
• B. Clear syntax such as separators and headers helps the model distinguish each stage of a multistep prompt.
• C. Maximizing temperature increases randomness, which works against consistent, verifiable multistep reasoning.
• D. Affordances let the model call an external capability like search, then continue reasoning with the real retrieved results.
• E. Merging stages into one unstructured instruction removes the structure that makes multistep reasoning reliable.

Correct answers: A, B — The Agent-to-Agent (A2A) protocol for cross-agent communication; A toolbox exposing a shared, versioned set of tools through one MCP endpoint

• A. The A2A protocol is designed specifically to connect an agent to other agents through compatible endpoints, matching the orchestrator-to-specialist handoff scenario.
• B. A shared toolbox lets multiple agents, including an orchestrator and specialists, consume the same curated tool set through one versioned MCP-compatible endpoint.
• C. Raising the token limit changes how much text a model can process per call; it doesn't establish a connection between separate agents.
• D. Disabling authentication removes access control rather than connecting agents, and it weakens security instead of supporting a governed handoff.
• E. Fine-tuning datasets shape a model's learned behavior over time; they aren't a mechanism for routing subtasks between separately published agents.

Correct answers: A, B, C — A dedicated Microsoft Entra identity per agent; Private networking with virtual network isolation; Integrated content safety and guardrails

• A. A dedicated Microsoft Entra identity per agent enables secure, scoped access to resources without sharing credentials, matching the enterprise identity control the team is checking for.
• B. Private networking lets agents run within a virtual network for isolation and data residency compliance, which is one of the documented enterprise capabilities.
• C. Integrated content safety and guardrails help mitigate unsafe outputs and prompt injection risks, another documented enterprise-grade control.
• D. Nightly automatic retraining of the underlying model isn't a documented Foundry capability and isn't how model updates are governed.
• E. Unlimited compute with no throttling isn't a real capability of the service; compute and rate limits still apply.

Correct answer: B — OpenAPI tool

• A. Code Interpreter runs Python in a sandboxed environment for analysis and computation; it doesn't connect to an external REST API using a specification.
• B. An OpenAPI tool connects an agent to external HTTP APIs by using an OpenAPI 3.0 or 3.1 specification, matching this configuration pattern exactly.
• C. Web search retrieves information from the public web with citations; it isn't a way to call a specific internal REST API described by a specification.

Correct answer: A — Azure Monitor alerts integrated with the observability dashboard

• A. Azure Monitor alerts, integrated with the Foundry observability dashboard, notify teams when production outputs fail quality thresholds or produce harmful content, matching this requirement exactly.
• B. A one-time pre-production evaluation validates readiness before deployment but does not continuously monitor or alert on live production traffic.
• C. Adding chain-of-thought instructions changes how the model reasons through a prompt; it has no mechanism for sending operational alerts.
• D. Changing top_p adjusts output randomness and has no relationship to alerting on production quality or safety failures.

Correct answers: A, B — Groundedness and relevance for RAG-specific quality; Coherence and fluency for general-purpose quality

• A. Groundedness and relevance are RAG-specific built-in evaluator metrics that measure whether a response is supported by retrieved context and relevant to the query.
• B. Coherence and fluency are general-purpose quality metrics among the built-in evaluators that assess response readability and logical flow.
• C. Virtual network peering configuration is a networking concern unrelated to evaluating generative AI response quality.
• D. Storage account redundancy tier is a storage infrastructure setting and is not a generative AI quality evaluation metric.

Correct answer: A — True

• A. This matches the documented distinction: Hosted agents run developer-written code such as Agent Framework or LangGraph, while prompt agents are configuration-only and Foundry manages the runtime entirely.
• B. This would be false only if the roles were reversed, but Hosted agents genuinely require maintained runtime code and prompt agents genuinely require none, so the statement holds.

Correct answer: B — False

• A. The documented response format for these endpoints returns base64-encoded image data; a direct URL response option is not offered.
• B. This is correct: all models return base64-encoded images, with no URL-based response format available.

Correct answer: B — False

• A. Video generation is documented as an asynchronous process: a job is created, the client polls a status endpoint, and the video is retrieved separately once the job succeeds.
• B. This is correct: the create-job call returns immediately with a job ID, and the caller must poll for status before downloading the finished clip.

Correct answer: A — Increase the completion's max token limit and rewrite the prompt to explicitly request a thorough, multi-sentence description of the image's visual details

• A. Raising the token limit and explicitly asking the model to elaborate on visual details is the correct way to move from a concise caption to an extended, multi-sentence description from the same vision-capable model.
• B. Lowering the image detail setting reduces token usage and can reduce recognition accuracy; it does not instruct the model to write a longer, more detailed narrative.
• C. Two independent one-sentence calls concatenated together typically produce redundant or disjointed text rather than one coherent, detailed description.
• D. A text-only model has no image input at all, so it cannot analyze the photo's colors, materials, or background context.

Correct answer: A — Include all five images as separate image content parts in one chat request, with a prompt asking for a single combined summary

• A. Vision-capable chat models accept multiple images as separate content parts within one request, letting a single prompt ask for one summary that spans the whole set of photos.
• B. Caption strings from independent requests cannot be meaningfully averaged; this produces nonsense text rather than a coherent combined summary.
• C. Merging five photos into one composite image degrades individual detail and is not how multi-image captioning is implemented.
• D. A folder path is plain text with no visual content attached, so the model has nothing to actually see or describe.

Correct answer: A — Call the Analyze multimodal (image with text) API so the image and its overlaid text are scored together as one unit

• A. The multimodal (image with text) analysis model is purpose-built to score an image and its accompanying text together, which is exactly what's needed when risk emerges from the combination rather than either input alone.
• B. Raising the image-only threshold still never looks at the caption text, so it cannot capture harm that only appears once the caption is read alongside the picture.
• C. Running two separate text passes and averaging scores still evaluates the picture's visual content and the text as disconnected signals, missing the combined-context risk the multimodal model is built to catch.
• D. Dropping image analysis entirely would miss cases where the picture itself is what turns an otherwise neutral caption into harmful content.

Correct answers: A, B — Analyze Image API scoring against the Hate category; Custom categories (rapid) API for the newly identified symbol

• A. The Analyze Image API's Hate category is part of the default harm taxonomy and would catch avatar content matching known discriminatory symbols.
• B. Custom categories (rapid) is designed to let a team define and scan for a newly identified harmful pattern that the default categories don't yet cover, addressing the second goal directly.
• C. Groundedness detection checks whether LLM text output matches source documents, which has no role in screening uploaded avatar images.
• D. Protected material text detection scans generated text for known copyrighted content, not uploaded images for prohibited symbols.
• E. Task adherence evaluates AI agent tool-use behavior against user intent, unrelated to screening avatar image uploads.
• F. Prompt Shields for user prompts screens typed text for jailbreak attempts, not image uploads for prohibited visual symbols.

Correct answer: A — The Azure Translator text translation API, which translates short text strings synchronously to one or more target languages

• A. The text translation API takes short text input and returns translations to one or more target languages synchronously, matching a real-time itinerary confirmation flow with no storage dependency.
• B. Batch document translation is asynchronous and requires Blob storage containers for source and translated files, which adds infrastructure the scenario explicitly wants to avoid.
• C. Speech translation operates on spoken audio input, not the written itinerary text the booking site is generating.
• D. Document Intelligence extracts fields and layout from documents like forms and invoices; it does not perform language translation.

Correct answer: A — True

• True. This is correct: opinion mining extends sentiment analysis by pairing sentiment with specific aspects, such as product attributes, rather than stopping at a single overall score.
• False. This is incorrect: opinion mining is explicitly defined as aspect-based sentiment analysis, providing granular target-and-assessment pairs beyond a whole-document score.

Correct answer: A — Fast transcription API, which synchronously returns the complete transcript faster than real-time processing of the recording

• A. Fast transcription returns the full transcript synchronously with predictable, faster-than-real-time latency, which matches the need for a quick subtitle set.
• B. Real-time speech to text is built for live microphone or streaming audio, not for quickly transcribing a file that already exists.
• C. Batch transcription is asynchronous and suited to large volumes of files rather than a single video needing a fast, predictable turnaround.
• D. Live Interpreter performs speech translation with language detection, which is unrelated to generating same-language subtitles for an uploaded video.

Correct answers: A, B, C — Audio recordings paired with human-labeled transcripts to improve recognition under specific audio conditions; Related text data used to teach the model domain-specific vocabulary and phrasing; Structured text following a defined pattern, used to specify custom pronunciations

• A. Audio paired with human-labeled transcripts helps the model adapt to specific audio conditions, such as accents or background noise, present in the target domain.
• B. Related text data teaches the model domain-specific vocabulary and phrasing that the general base model may not recognize accurately.
• C. Structured text following a defined pattern can specify custom pronunciations and helps the model recognize consistently patterned utterances.
• D. Synthesized speech generated by an unrelated vendor's engine is not a supported custom speech training data type and does not reflect real spoken audio conditions.
• E. Sentiment-labeled text has no defined role in custom speech training, which focuses on vocabulary and audio conditions rather than emotional tone.

Correct answers: A, B, E — Translating beyond two target languages requires creating a Foundry multi-service resource or using a separate translation service; Translation fees apply for each additional target language beyond the second, based on the character count translated; The intermediate speech recognition results contribute to the character count used for calculating translation costs

• A. Going beyond two target languages requires creating a Foundry multi-service resource or using a separate translation service for the additional languages.
• B. Translation costs apply for each target language beyond the second, calculated based on the character count of the translated text.
• C. The standard speech translation API directly supports only two target languages per request; more requires the additional resource configuration described above.
• D. The Speech SDK and Speech CLI remain the interface used; a multi-service resource extends the same speech translation capability rather than forcing a move to a text-only client.
• E. Because intermediate speech recognition results are also translated as speech is detected, they add to the character volume used when calculating translation charges.

Correct answer: A — The indexer extracts text and images from source documents so they can be enriched and indexed

• A. Document cracking is the step where the indexer opens source files and extracts their text and image content, which then feeds the enrichment pipeline and indexing.
• B. Documents that fail validation are typically skipped or logged as errors, not permanently deleted, and this behavior is unrelated to the extraction step of cracking.
• C. Vector fields are not automatically converted to filterable text fields; filterable text or numeric fields must be explicitly modeled in the index schema.
• D. Encryption of stored content is a storage and security concern handled separately from document cracking, which is specifically about extracting content for processing.

Correct answers: A, B, C — A data source that connects to the source content; A skillset that defines the enrichment steps to run; An index that stores the enriched and searchable output

• A. A data source is required so the indexer knows where to connect and pull content from before any enrichment can begin.
• B. A skillset defines the atomic enrichment steps that transform cracked documents into enriched output, making it a required part of the pipeline.
• C. An index is required because the indexer must have a target schema to load enriched and raw content into for querying.
• D. A knowledge store is an optional output defined within a skillset for downstream apps; a pipeline can run and populate an index without ever defining one.
• E. Synonym maps improve query-time term matching but are not a required component for the indexer, skillset, and index combination that defines an enrichment pipeline.
• F. Scoring profiles tune relevance ranking at query time and are optional refinements, not a required object for the pipeline to run.

Correct answer: A — True

• A. This is correct: hybrid search runs the keyword and vector queries in parallel and combines their results into a single unified, ranked response.
• B. This statement accurately describes hybrid search behavior, so marking it false would be incorrect given how hybrid queries execute and merge results.

Correct answer: A — A custom neural model, which is designed to extract data from mixed-type documents

• A. Custom neural models are built to handle documents with varying structures and layouts, which fits a manifest set that differs by carrier and has no consistent structure.
• B. Custom template models are tuned for static layouts and perform best when documents share a consistent visual structure, which does not match manifests that vary by carrier.
• C. A custom classifier only identifies which document type a file belongs to before routing it to an extraction model; it does not itself extract fields from mixed layouts.
• D. A custom composed model groups several standalone extraction models behind one endpoint, but the underlying models still need to individually handle the variability, so this does not replace choosing the right model type for mixed layouts.

Correct answer: B — False

• A. This statement is inaccurate: the General document model is a prebuilt model that extracts text, structure, and key-value pairs without requiring any custom training or labeling.
• B. This is correct: the General document model is prebuilt and ready to use immediately, so no labeled training dataset is required before extraction can begin.