CertSafari

    Free Microsoft Azure Designing and Implementing Multi-Agent AI Solutions (AI-500) Sample Questions

    35 free sample questions from our bank of 357+, covering every exam domain, with answers and detailed explanations. Updated August 2026.

    Practice all 357 questions in quiz mode

    Domain 1: Architect multi-agent solutions

    Subdomain 1.1: Design logical architecture for multi-agent solutions

    1.A team is building an internal assistant that answers varied questions within a single product domain, occasionally looking up order status or querying a database. Requests don't require distinct security boundaries or truly parallel specialization. What is the most appropriate architecture per the guidance on choosing complexity?

    1. A.A multiagent orchestration with a dedicated agent per possible query type
    2. B.A single agent with tool access and iteration limits to guard against runaway tool-call loops
    3. C.A magentic manager agent that builds a task ledger for every incoming question
    4. D.A group chat of three agents that debate each answer before responding
    Show answer & explanation

    Correct answer: B — A single agent with tool access and iteration limits to guard against runaway tool-call loops

    • A. Splitting every query type into its own agent adds coordination overhead and latency that isn't justified when a single domain and dynamic tool use are enough to handle the workload.
    • B. A single agent with tools that reasons and calls dynamic tools like order lookups is often the right default for this kind of enterprise scenario, and it's simpler to debug and test than a multiagent setup, provided iteration limits guard against infinite tool-call loops.
    • C. Magentic orchestration is built for open-ended problems with no predetermined solution path, which is unnecessary complexity for routine, well-understood single-domain questions.
    • D. A three-agent debate adds conversational overhead and control complexity that isn't warranted for straightforward, single-domain queries that one agent with tools can already resolve.

    Subdomain 1.1: Design logical architecture for multi-agent solutions

    2.A finance team is deploying an agent that approves employee expense reimbursements. Leadership wants the agent to act independently on routine, low-risk approvals but require a human reviewer's explicit sign-off for anything unusual or high-value. Which design specification addresses this requirement?

    1. A.A fixed autonomy level that lets the agent execute every reimbursement without any checkpoint, relying on post-hoc audit logs
    2. B.A scoped autonomy level with an explicit boundary that routes reimbursements above a threshold or with anomalous attributes to a human-in-the-loop approval gate
    3. C.Unrestricted tool access to the payment system, leaving the persona instructions alone to decide when a human should be consulted
    4. D.A read-only role in a group chat so a human always drafts the final reimbursement decision
    Show answer & explanation

    Correct answer: B — A scoped autonomy level with an explicit boundary that routes reimbursements above a threshold or with anomalous attributes to a human-in-the-loop approval gate

    • A. Letting the agent execute every reimbursement without a checkpoint removes the mandatory human review leadership asked for, and audit logs only detect problems after the fact rather than preventing them.
    • B. Defining a scoped autonomy level with a clear boundary condition that triggers a human-in-the-loop gate for high-value or anomalous cases directly matches the requirement for independent handling of routine work paired with mandatory human review of exceptions.
    • C. Granting unrestricted payment-system access and relying solely on persona wording to decide when to involve a human leaves no enforced boundary, so the agent could still approve risky reimbursements on its own.
    • D. Making the agent purely read-only in a group chat removes its ability to act independently on routine approvals at all, which is more restrictive than the requirement calls for.

    Subdomain 1.1: Design logical architecture for multi-agent solutions

    3.To maintain effective control over conversation flow and prevent it from becoming difficult to manage, group chat orchestration should generally be limited to three or fewer agents.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: A — True

    • A. This is accurate: managing conversation flow and preventing infinite loops becomes harder as more agents participate, so limiting group chat to three or fewer agents is the recommended way to maintain effective control.
    • B. This is inaccurate: the guidance specifically recommends capping group chat participation at three or fewer agents because more agents make the discussion harder to control.

    Subdomain 1.2: Specify technology components to include in a multi-agent solution

    4.A regulated healthcare customer requires that agent conversation threads, files, and vector data never reside in Microsoft-managed multitenant storage, and must be encrypted with keys the customer controls. Which architecture meets this compliance mapping?

    1. A.Use the Standard setup with bring-your-own Storage, Cosmos DB, and AI Search, plus customer-managed keys through Key Vault.
    2. B.Use the Basic setup, which stores threads and files in the platform's built-in managed storage by default.
    3. C.Use the Developer deployment type, which has a 24-hour lifetime and no SLA for fine-tuned evaluation only.
    4. D.Use only Global Standard model deployment, since deployment type alone determines where conversation data is stored.
    Show answer & explanation

    Correct answer: A — Use the Standard setup with bring-your-own Storage, Cosmos DB, and AI Search, plus customer-managed keys through Key Vault.

    • A. Standard setup requires bringing your own Azure Storage, Cosmos DB, and AI Search so all customer data is isolated in the customer's own resources, and connecting a customer-managed Key Vault satisfies the encryption-key control requirement.
    • B. Basic setup stores threads, messages, and files in Microsoft-managed multitenant storage with only logical separation, which does not satisfy a requirement that data never reside in platform-managed storage.
    • C. The Developer deployment type is a short-lived, no-SLA option scoped to fine-tuned model evaluation and does not address where conversation threads or files are persisted.
    • D. Model deployment type controls where inference processing occurs, not where conversation threads, files, and vector stores are persisted, so it does not by itself meet a data-residency requirement.

    Subdomain 1.2: Specify technology components to include in a multi-agent solution

    5.A platform team wants to define a curated set of tools once, version changes safely, and expose them to any MCP-compatible agent runtime through a single standardized endpoint, regardless of which framework each agent uses. Which component should they use?

    1. A.A Toolbox, exposed through its single MCP-compatible endpoint with explicit version promotion.
    2. B.A separate tool registration copied manually into every individual agent's configuration.
    3. C.A custom REST wrapper reimplemented once for each agent framework in use.
    4. D.The default Responses API tool catalog without any centrally managed tool set.
    Show answer & explanation

    Correct answer: A — A Toolbox, exposed through its single MCP-compatible endpoint with explicit version promotion.

    • A. Toolbox lets a team define a curated tool set once, manage it centrally, and expose it through a single MCP-compatible endpoint that any MCP-compatible runtime can consume, with versioning to control when changes take effect.
    • B. Copying tool registrations into each agent's own configuration duplicates the work per agent and loses the single centrally governed, versioned endpoint the team wants.
    • C. Reimplementing a custom wrapper per framework recreates framework-specific integration work instead of relying on the framework-agnostic MCP-compatible endpoint Toolbox already provides.
    • D. The default platform tool catalog gives access to built-in tools like file search and code interpreter, but it is not a mechanism for centrally curating and versioning a custom tool set across frameworks.

    Subdomain 1.2: Specify technology components to include in a multi-agent solution

    6.True or False: In Microsoft Foundry, customer workloads run in logically isolated environments per Foundry resource, and customer code does not share runtime containers with other tenants.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: A — True

    • A. This statement is accurate: Foundry's architecture documentation states that workloads run in logically isolated environments per Foundry resource and that customer code doesn't share runtime containers with other tenants.
    • B. This statement is not false; tenant isolation at the runtime-container level is a documented characteristic of the Foundry compute architecture, not a misconception.

    Domain 2: Develop multi-agent solutions in Azure

    Subdomain 2.1: Design and implement advanced prompt engineering strategies in multi-agent solutions

    7.A team is preparing a fine-tuning dataset for an Azure OpenAI model and wants to know how many high-quality examples they should target to see meaningful improvement, based on Microsoft's general guidance. Which statement best reflects that guidance?

    1. A.A few hundred high-quality examples can show improvement, while thousands are recommended for stronger results
    2. B.Fewer than ten examples are always sufficient because the base model already generalizes from minimal input
    3. C.Exactly one million examples are required before Azure OpenAI will accept a fine-tuning job
    4. D.The number of examples does not matter as long as the file is under the maximum upload size limit
    Show answer & explanation

    Correct answer: A — A few hundred high-quality examples can show improvement, while thousands are recommended for stronger results

    • A. This matches Microsoft's general guidance: a few hundred high-quality examples can produce meaningful improvement, while thousands of examples are recommended to generalize well.
    • B. Ten or fewer examples is far too small to reliably influence model behavior through fine-tuning and does not reflect the recommended guidance.
    • C. There is no fixed requirement of exactly one million examples for a fine-tuning job to be accepted.
    • D. Dataset size directly affects how well the model generalizes; staying under an upload size limit does not mean example count is irrelevant to quality.

    Subdomain 2.1: Design and implement advanced prompt engineering strategies in multi-agent solutions

    8.A fine-tuned support agent's accuracy has been declining over several months as customer terminology and product names have evolved. Which fine-tuning strategy addresses this kind of gradual performance drift?

    1. A.Periodically retrain the model on a refreshed dataset that reflects current terminology and product names
    2. B.Keep using the original fine-tuned model indefinitely since fine-tuning only needs to happen once per model
    3. C.Increase the model's temperature setting to make responses feel fresher without changing the training data
    4. D.Switch to a larger base model without fine-tuning it on any updated data
    Show answer & explanation

    Correct answer: A — Periodically retrain the model on a refreshed dataset that reflects current terminology and product names

    • A. Periodic retraining on a refreshed dataset directly addresses drift caused by evolving terminology, since the model's learned patterns are updated to match current language.
    • B. Treating fine-tuning as a one-time event is precisely why the model has drifted out of date as terminology changed over time.
    • C. Temperature affects output randomness, not the model's underlying knowledge of current terminology, so it does not address drift.
    • D. A larger base model without fine-tuning on updated, domain-specific terminology would not necessarily reflect the current product names the agent needs to know.

    Subdomain 2.1: Design and implement advanced prompt engineering strategies in multi-agent solutions

    9.What file format does Azure OpenAI require for fine-tuning training and validation data?

    1. A.JSON Lines (JSONL), with each line representing one training example in conversational format
    2. B.A single flat CSV file with one column containing raw unstructured text
    3. C.A compressed ZIP archive containing individual plain-text files for each example
    4. D.An XML document with each training example wrapped in custom schema tags
    Show answer & explanation

    Correct answer: A — JSON Lines (JSONL), with each line representing one training example in conversational format

    • A. Azure OpenAI fine-tuning requires JSON Lines files, where each line is one training example formatted in the conversational schema used by the chat completions API.
    • B. A flat CSV with unstructured text does not provide the structured conversational format the fine-tuning service expects.
    • C. Fine-tuning data is not submitted as a ZIP archive of separate plain-text files; it must be a single JSONL file per dataset.
    • D. XML with custom tags is not a supported format for Azure OpenAI fine-tuning data submission.

    Subdomain 2.2: Design and implement agent memory, context management, and knowledge integration

    10.A team builds a customer-support agent in Foundry Agent Service that must keep each customer's remembered preferences separate from every other customer, without hard-coding customer identifiers into the agent configuration. Which approach satisfies this requirement?

    1. A.Set the memory search tool's `scope` parameter to `{{$userId}}` so the service resolves the caller's identity from the `x-memory-user-id` header or Microsoft Entra token on each call.
    2. B.Configure a single static `scope` value for the memory store and rely on `user_profile_details` to exclude any customer-identifying details from stored memories.
    3. C.Create one memory store per customer at agent design time and route each conversation to the matching store using a lookup table maintained in application code.
    4. D.Disable `chat_summary_enabled` for the memory store so no conversation content is retained, then rebuild customer context from support ticket history at the start of every session.
    Show answer & explanation

    Correct answer: A — Set the memory search tool's `scope` parameter to `{{$userId}}` so the service resolves the caller's identity from the `x-memory-user-id` header or Microsoft Entra token on each call.

    • A. Setting scope to `{{$userId}}` lets the service automatically resolve per-user identity from the `x-memory-user-id` header or, absent that, the caller's Microsoft Entra tenant and object ID, giving isolation without hard-coded IDs.
    • B. A single static scope keeps all customers' memories in the same partition, so any customer's data could surface for another regardless of what fields are excluded from extraction.
    • C. Manually creating and routing to per-customer stores duplicates functionality the built-in scope mechanism already provides and adds unnecessary operational overhead.
    • D. Turning off chat summaries removes conversation content from memory entirely rather than isolating it per customer, and does not address identifier hard-coding.

    Subdomain 2.2: Design and implement agent memory, context management, and knowledge integration

    11.In the classic RAG pattern with Azure AI Search, what does semantic ranking do to search results before they are sent to the language model?

    1. A.Re-scores results based on meaning rather than keyword overlap alone, surfacing the most contextually relevant matches.
    2. B.Removes all vector embeddings from the index to force keyword-only matching for lower latency.
    3. C.Replaces hybrid search with a single vector query so only similarity scores determine ranking.
    4. D.Applies OCR to scanned images within documents so image-based content becomes searchable text.
    Show answer & explanation

    Correct answer: A — Re-scores results based on meaning rather than keyword overlap alone, surfacing the most contextually relevant matches.

    • A. Semantic ranking re-scores the initial result set based on meaning rather than raw keyword overlap, improving relevance for the top results passed to the LLM.
    • B. Semantic ranking does not remove vector embeddings from the index; it operates on top of results that can come from keyword, vector, or hybrid queries.
    • C. Semantic ranking is a re-ranking step applied after retrieval, not a replacement for hybrid search or a restriction to vector-only queries.
    • D. OCR and image verbalization are separate content-preparation skills used during indexing, not part of what semantic ranking does at query time.

    Subdomain 2.2: Design and implement agent memory, context management, and knowledge integration

    12.An MCP tool must call a downstream API on behalf of the specific end user interacting with the agent, so that the downstream API enforces that user's own permissions rather than a shared service identity. Which Foundry MCP authentication option is designed for this case?

    1. A.OAuth identity passthrough, which exchanges tokens so the call executes with the signed-in user's own identity.
    2. B.Key-based authentication, which uses a single shared function key for every user regardless of who is signed in.
    3. C.Unauthenticated access, which is recommended for internal enterprise tools handling user-specific permissions.
    4. D.Microsoft Entra project managed identity, which always represents the Foundry project rather than an individual end user.
    Show answer & explanation

    Correct answer: A — OAuth identity passthrough, which exchanges tokens so the call executes with the signed-in user's own identity.

    • A. OAuth identity passthrough, also called on-behalf-of authentication, exchanges tokens so the downstream call runs under the signed-in user's own identity and permissions, matching the requirement exactly.
    • B. Key-based authentication uses one shared credential for all callers, so the downstream API cannot distinguish or enforce permissions for individual end users.
    • C. Unauthenticated access is supported only for limited scenarios and is not recommended for production workloads, especially ones requiring per-user permission enforcement.
    • D. A project managed identity represents the Foundry project itself, not the individual signed-in user, so downstream permission checks would apply to the project rather than the end user.

    Subdomain 2.3: Build and integrate tool ecosystems

    13.An agent calls an MCP tool that queries an internal HR system and returns an employee's manager and salary band. Before the agent uses this data to answer a user's question, what validation practice should be applied?

    1. A.Treat the tool's response as untrusted input and verify the returned fields match expected types and ranges before acting on them.
    2. B.Pass the raw tool response directly into the agent's reply to the user without inspecting its contents, since MCP responses are inherently trusted.
    3. C.Skip validation because the tool already performed authentication, so any data it returns must automatically be safe to use unchecked.
    4. D.Cache the first tool response permanently and reuse it for all future queries instead of validating each newly returned response.
    Show answer & explanation

    Correct answer: A — Treat the tool's response as untrusted input and verify the returned fields match expected types and ranges before acting on them.

    • A. Foundry guidance recommends treating tool outputs as untrusted input and validating critical fields before the agent acts on or discloses sensitive data.
    • B. Passing raw, unvalidated tool output straight into a reply risks surfacing incorrect or unexpected data; MCP responses are not inherently trusted.
    • C. Authentication only confirms who called the tool, not that the returned data is well-formed or appropriate to disclose, so validation is still needed.
    • D. Permanently caching one response ignores that the underlying HR data can change, and it does not address validating the correctness of returned values.

    Subdomain 2.3: Build and integrate tool ecosystems

    14.An agent needs to call an MCP tool that performs actions in a SaaS system strictly using the permissions of the specific signed-in end user, not a shared service identity. Which MCP authentication option should be configured?

    1. A.OAuth identity passthrough (On-Behalf-Of), exchanging tokens so the call executes with the signed-in user's own permissions.
    2. B.Key-based authentication using a single shared function key applied uniformly for every user of the agent's tool.
    3. C.Microsoft Entra authentication using the project's managed identity, shared across every agent hosted in the project.
    4. D.Unauthenticated access, relying entirely on the downstream SaaS system's own login page for enforcement of permissions.
    Show answer & explanation

    Correct answer: A — OAuth identity passthrough (On-Behalf-Of), exchanging tokens so the call executes with the signed-in user's own permissions.

    • A. OAuth identity passthrough (OBO) exchanges tokens so the call runs with the signed-in user's own permissions, exactly matching the per-user enforcement requirement.
    • B. A shared function key applies the same identity to every user, which cannot enforce per-user permissions in the downstream SaaS system.
    • C. A shared project managed identity acts on behalf of the project as a whole, not the individual signed-in user, so it does not meet the requirement.
    • D. Leaving the tool call unauthenticated provides no mechanism to carry the signed-in user's identity into the downstream call at all.

    Subdomain 2.3: Build and integrate tool ecosystems

    15.A developer registers a new MCP server as an asset in Azure API Center, but teammates report the server does not appear in the Foundry organizational tool catalog. What is the most likely cause to check first?

    1. A.The API asset in API Center has not been published, or the teammates lack the access permissions configured in Manage Access.
    2. B.The MCP server was built using Azure Functions instead of Azure Logic Apps, which API Center does not support cataloging.
    3. C.The Foundry project region differs from the Azure subscription's default region, which always blocks catalog visibility entirely.
    4. D.The MCP server responds too quickly, and Foundry's catalog refresh requires a minimum response latency to index new entries.
    Show answer & explanation

    Correct answer: A — The API asset in API Center has not been published, or the teammates lack the access permissions configured in Manage Access.

    • A. An unpublished asset or missing access-management configuration is the documented first thing to check when a registered server does not surface in the catalog for other users.
    • B. API Center can catalog MCP servers regardless of the hosting technology used to build them, so the hosting choice is not the cause.
    • C. Region mismatches are not described as a blocker for catalog visibility in the registration and access-management flow.
    • D. Response latency of the MCP server has no bearing on whether it is indexed and visible in the Foundry tool catalog.

    Subdomain 2.4: Implement multi-agent orchestration

    16.An agent in a workflow attempts to call a tool that has been marked as requiring approval before execution. What happens in the Agent Framework workflow at this point?

    1. A.The workflow pauses, emits a tool approval request event, and waits for an external response before executing the tool.
    2. B.The workflow executes the tool immediately and logs the call for a human to review after the fact.
    3. C.The workflow terminates the entire run and requires resubmission once approval has been pre-granted.
    4. D.The workflow silently skips the tool call and proceeds directly to the next orchestration step.
    Show answer & explanation

    Correct answer: A — The workflow pauses, emits a tool approval request event, and waits for an external response before executing the tool.

    • A. An approval-required tool call pauses the workflow and emits a request event carrying the approval request; the run only continues once an external response is sent back through the response mechanism.
    • B. Running the tool first and reviewing afterward defeats the purpose of an approval-required tool, since the call is meant to be blocked until a human authorizes it beforehand.
    • C. Approval-required tools pause and can be resumed with a response, so the workflow does not need to terminate the entire run or be resubmitted from scratch.
    • D. Skipping the call silently would drop the requested action entirely instead of pausing for a decision, which is not how approval-required tools behave.

    Subdomain 2.4: Implement multi-agent orchestration

    17.For Azure OpenAI models in Microsoft Foundry that support prompt caching, what is the minimum prompt length required before a cache hit can occur, and at what token interval do additional cache matches extend afterward?

    1. A.At least 1024 tokens, with additional matches every 128 identical tokens after that.
    2. B.At least 512 tokens, with additional matches every 64 identical tokens after that.
    3. C.At least 2048 tokens, with additional matches every 256 identical tokens after that.
    4. D.At least 4096 tokens, with additional matches every 512 identical tokens after that.
    Show answer & explanation

    Correct answer: A — At least 1024 tokens, with additional matches every 128 identical tokens after that.

    • A. Prompt caching requires the first 1024 tokens to be identical to register a cache hit, and further matches extend in increments of 128 identical tokens beyond that point.
    • B. 512 tokens as a minimum and 64-token increments understate the documented thresholds, which are 1024 tokens minimum with 128-token extensions.
    • C. 2048 tokens as a minimum and 256-token increments overstate the documented thresholds, which are 1024 tokens minimum with 128-token extensions.
    • D. 4096 tokens as a minimum and 512-token increments overstate the documented thresholds by a wide margin; the actual minimum is 1024 tokens with 128-token extensions.

    Subdomain 2.4: Implement multi-agent orchestration

    18.Foundry Agent Service can only connect to MCP servers that are exposed on publicly accessible endpoints; private MCP server endpoints are not supported.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. This is not the correct assessment; Foundry Agent Service supports connecting to private MCP server endpoints in addition to publicly accessible ones, not exclusively public endpoints.
    • B. Agent Service can be configured to use private MCP server endpoints alongside publicly accessible ones, so the claim that only public endpoints are supported is incorrect.

    Domain 3: Evaluate, optimize, and monitor multi-agent solutions

    Subdomain 3.2: Optimize prompt and model performance for multi-agent solutions

    19.A multi-agent workflow periodically compresses conversation history into a running summary to conserve tokens. After several compression cycles, the summary states that a task was "approved" when the original transcript shows it was only "tentatively approved pending review." What is this failure mode called, and what is a valid mitigation?

    1. A.Summary drift; mitigate by retaining key verbatim excerpts or checkpoints alongside the summary instead of relying solely on repeated re-summarization
    2. B.Vector-only recall; mitigate by increasing the number of retrieved chunks returned from the vector index on each query
    3. C.Sliding-window amnesia; mitigate by extending the raw context window size so no truncation occurs during the session
    4. D.Entity continuity failure; mitigate by assigning a unique identifier to every entity mentioned in the conversation
    Show answer & explanation

    Correct answer: A — Summary drift; mitigate by retaining key verbatim excerpts or checkpoints alongside the summary instead of relying solely on repeated re-summarization

    • A. Correct. Repeated re-summarization compounds small inaccuracies over cycles, which is summary drift; keeping verbatim anchors or periodic checkpoints alongside the summary preserves fidelity that pure re-summarization erodes.
    • B. Incorrect. Vector-only recall concerns retrieval systems missing relevant content due to embedding limitations, not a summary progressively losing accuracy through repeated regeneration.
    • C. Incorrect. Sliding-window amnesia is caused by truncation of older turns, not by inaccuracies introduced through iterative summarization of retained content.
    • D. Incorrect. Entity continuity failure addresses tracking attributes of a specific entity across references, which does not describe a summary's overall fidelity degrading over successive compressions.

    Subdomain 3.2: Optimize prompt and model performance for multi-agent solutions

    20.True or False: Increasing the requests-per-minute (RPM) rate limit assigned to a deployment is achieved by directly configuring RPM independently of tokens-per-minute (TPM), since the two are unrelated settings in Azure OpenAI.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • True. Incorrect. RPM and TPM are not independent; RPM is set proportionally to the assigned TPM according to a per-model ratio, so adjusting TPM directly changes the associated RPM limit.
    • False. Correct. When quota is assigned to a deployment, TPM is the primary unit allocated, and RPM is derived proportionally from it using a model-specific ratio rather than being configured as a separate independent value.

    Subdomain 3.2: Optimize prompt and model performance for multi-agent solutions

    21.A multi-agent workflow includes a research agent, a drafting agent, and a fact-checking agent that all depend on outputs from a shared retrieval agent before they can begin their own work. Once the retrieval agent finishes, the three downstream agents can each work independently. How should the orchestrator be structured to minimize total task duration?

    1. A.Run the retrieval agent first, then dispatch the research, drafting, and fact-checking agents concurrently once retrieval completes
    2. B.Run all four agents concurrently from the start, since parallel execution always reduces duration regardless of data dependencies
    3. C.Run the retrieval agent, then the research agent, then the drafting agent, then the fact-checking agent, each waiting for the previous to finish
    4. D.Run the retrieval agent twice in parallel to reduce the risk of failure, then run the remaining three agents sequentially afterward
    Show answer & explanation

    Correct answer: A — Run the retrieval agent first, then dispatch the research, drafting, and fact-checking agents concurrently once retrieval completes

    • A. Correct. Because the three downstream agents genuinely depend on the retrieval agent's output, it must run first, but since research, drafting, and fact-checking are independent of each other afterward, running them concurrently minimizes the remaining duration.
    • B. Incorrect. Running all four agents concurrently from the start ignores the real dependency where research, drafting, and fact-checking need the retrieval agent's output, which would produce incorrect or incomplete results.
    • C. Incorrect. Running the three downstream agents strictly sequentially adds unnecessary wall-clock time, since they do not depend on each other once retrieval has completed.
    • D. Incorrect. Duplicating the retrieval agent run adds cost and token usage without addressing the actual duration bottleneck, and returning to sequential execution for the remaining agents still wastes available parallelism.

    Subdomain 3.1: Design and implement evaluation and validation strategies for multi-agent solutions

    22.A Foundry agent builder is designing a human evaluation template and wants reviewers to rate the helpfulness of each agent response on a numeric scale from 1 to 5. Which supported question type should the builder add to the template?

    1. A.Free-form text
    2. B.Slider
    3. C.Thumbs up/down
    4. D.Multiple choice
    Show answer & explanation

    Correct answer: B — Slider

    • A. Free-form text captures open-ended written feedback rather than a bounded numeric rating, so it does not give a clean 1-5 helpfulness score.
    • B. A slider lets reviewers pick a value along a numeric range such as 1 to 5, which is exactly the format needed to score helpfulness on that scale.
    • C. Thumbs up/down only captures a binary judgment, so it cannot express graded helpfulness across a five-point range.
    • D. Multiple choice presents a fixed set of labeled options, which suits categorical judgments rather than a continuous numeric rating.

    Subdomain 3.1: Design and implement evaluation and validation strategies for multi-agent solutions

    23.Before an agent builder can enable human evaluation for a Foundry agent, which prerequisite must already be configured for the project?

    1. A.Application Insights connected to the project
    2. B.A custom evaluator registered in the Evaluator Library
    3. C.A scheduled red-teaming run completed for the agent
    4. D.A production deployment slot assigned to the agent
    Show answer & explanation

    Correct answer: A — Application Insights connected to the project

    • A. Human evaluation stores results in Application Insights, so it must already be configured for the project before reviewers can capture and later download evaluation data.
    • B. Human evaluation relies on reviewer-completed templates rather than the Evaluator Library, so registering a custom evaluator there is not a prerequisite.
    • C. Red teaming is a separate adversarial testing capability and completing a run is not required before enabling human evaluation.
    • D. Human evaluation runs through the agent's preview experience and does not require a production deployment slot to be configured first.

    Subdomain 3.1: Design and implement evaluation and validation strategies for multi-agent solutions

    24.An agent stores extracted facts in a managed memory store, and the security team is concerned an attacker could inject false statements into a conversation that later get consolidated into persistent memory. Which pair of mitigations directly addresses this risk?

    1. A.Validate prompts with Content Safety prompt injection detection and run adversarial testing against the memory system
    2. B.Increase the default TTL on the memory store and disable item-level memory deletion
    3. C.Move the memory store into a virtual network and disable the memory search tool
    4. D.Switch from chat summary memory to procedural memory and remove the embedding model
    Show answer & explanation

    Correct answer: A — Validate prompts with Content Safety prompt injection detection and run adversarial testing against the memory system

    • A. Validating prompts entering or leaving the memory system with prompt injection detection, combined with regular adversarial stress-testing, are the documented mitigations for memory corruption and injection risk.
    • B. Lengthening retention and removing the ability to delete items would make corrupted memories persist longer and harder to correct, worsening rather than mitigating the risk.
    • C. Virtual network integration is not supported for memory stores, and disabling the memory search tool removes functionality without addressing how false content gets consolidated.
    • D. Changing which memory type is used does not validate incoming content for injected falsehoods, and memory requires a compatible embedding model to function at all.

    Subdomain 3.3: Design and implement observability and monitoring for multi-agent solutions

    25.A shared Foundry project serves three internal business units, and finance wants each unit billed only for the token and compute usage its own agents generate. Which cost management practice enables this?

    1. A.Tag agent deployments and resources by business unit and use those tags to allocate costs for chargeback
    2. B.Set a single organization-wide token limit shared equally across all deployed agents
    3. C.Disable tracing for two of the three business units to reduce telemetry storage costs
    4. D.Consolidate all three business units onto one agent deployment to simplify billing
    Show answer & explanation

    Correct answer: A — Tag agent deployments and resources by business unit and use those tags to allocate costs for chargeback

    • A. Tagging deployments and resources by business unit lets Azure Cost Management attribute usage-based costs to the correct owner, which is the standard mechanism for chargeback reporting in a shared project.
    • B. An equal shared token limit caps usage but does not attribute actual consumption to the specific business unit that generated it, so it cannot produce accurate chargeback figures.
    • C. Disabling tracing for some units reduces telemetry costs but removes the visibility needed to measure and attribute their usage, working against accurate chargeback rather than enabling it.
    • D. Consolidating all units onto one deployment would make it harder, not easier, to separate each unit's usage for individual billing since their activity would be mixed together.

    Subdomain 3.3: Design and implement observability and monitoring for multi-agent solutions

    26.A Foundry agent occasionally times out mid-task. Is it true that enabling distributed tracing alone, without any alerting configuration, is sufficient to ensure the operations team is notified in real time when such a timeout occurs?

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. Tracing only records what happened during a run; it does not push a notification to anyone on its own, so relying on tracing alone would not achieve real-time notification.
    • B. Tracing captures telemetry, but someone must actively query or view it unless alert rules are separately configured against relevant metrics or thresholds, so tracing alone does not provide real-time notification.

    Subdomain 3.3: Design and implement observability and monitoring for multi-agent solutions

    27.A team enables content recording so full prompts and model outputs are captured in tracing during local development, then leaves the same content recording setting enabled after promoting the agent to production. Is this the recommended practice?

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. Leaving full content recording enabled in production is not the recommended practice, since it increases the risk of sensitive user data being captured and retained in telemetry.
    • B. The recommended practice is to enable content recording during development and debugging but disable it in production, redacting sensitive content before it reaches telemetry.

    Domain 4: Secure, govern, and deploy multi-agent solutions

    Subdomain 4.1: Design and implement security for multi-agent solutions

    28.A team publishes a Foundry agent that previously ran unpublished in the same project. After publishing, the agent's calls to an MCP server backed by Azure Storage start failing with 403 errors, even though the storage RBAC assignment worked before publishing and nothing else changed. What is the most likely cause?

    1. A.Publishing the agent generated a new distinct agentIdentityId, and the Storage Blob Data Contributor role was never reassigned to that new identity.
    2. B.Publishing the agent revoked the OAuth 2.0 audience registered for Azure Storage, so the token exchange now targets the wrong resource identifier.
    3. C.Publishing the agent moved the MCP server connection to key-based authentication, which Storage no longer accepts for blob operations.
    4. D.Publishing the agent disabled the shared project identity, so unpublished sibling agents in the project lose their storage access entirely.
    Show answer & explanation

    Correct answer: A — Publishing the agent generated a new distinct agentIdentityId, and the Storage Blob Data Contributor role was never reassigned to that new identity.

    • A. Correct. Publishing an agent creates a new distinct agent identity separate from the shared project identity, and any RBAC roles the agent needs must be manually reassigned to that new identity.
    • B. Incorrect. Audience values are fixed resource identifiers for a downstream service, such as https://storage.azure.com, and publishing an agent does not change or revoke them.
    • C. Incorrect. Publishing an agent does not alter the authentication type configured on an existing tool connection from agent identity to key-based auth.
    • D. Incorrect. Publishing one agent gives that agent its own distinct identity but does not disable the shared project identity used by other unpublished agents.

    Subdomain 4.1: Design and implement security for multi-agent solutions

    29.A team lead needs to create new Foundry projects and manage model deployments, but should not need broader subscription-level resource management rights. Which built-in Foundry role fits this scenario?

    1. A.Foundry Project Manager, which includes model deployment creation and update alongside project creation.
    2. B.Foundry User, which grants data plane usage only and no rights to create projects or deployments.
    3. C.Foundry Account Owner, which grants high-privilege resource management including key rotation across the account.
    4. D.Foundry Owner, which combines full resource management with data plane access for self-serve users.
    Show answer & explanation

    Correct answer: A — Foundry Project Manager, which includes model deployment creation and update alongside project creation.

    • A. Correct. This role is designed for team leads who need to create projects and manage model deployments without full account-level resource management.
    • B. Incorrect. This role covers data plane usage such as building agents on pre-deployed models, but it does not grant project creation or deployment management.
    • C. Incorrect. This role is a high-privilege administrative role for account-wide resource management, which exceeds what a team lead managing deployments needs.
    • D. Incorrect. This role bundles full resource management with data plane access, granting broader rights than the scoped project and deployment work described.

    Subdomain 4.1: Design and implement security for multi-agent solutions

    30.Which of the following practices align with least-privilege RBAC assignment for Foundry agent identities? (Select all that apply.)(Select 3)

    1. A.Assigning roles at the narrowest resource or resource-group scope the agent actually needs, rather than at the subscription scope.
    2. B.Reassigning role assignments to the new agentIdentityId whenever an agent moves from unpublished to published status.
    3. C.Granting Foundry Owner to every agent identity by default so future tool additions never require a new role assignment.
    4. D.Treating the shared project identity as having a broader blast radius and publishing agents that need tighter, separately audited access.
    5. E.Embedding a long-lived client secret directly in the agent's prompt so tool calls never depend on RBAC role assignments.
    6. F.Skipping role verification after publishing, since Foundry automatically copies role assignments to the new distinct identity.
    Show answer & explanation

    Correct answers: A, B, D — Assigning roles at the narrowest resource or resource-group scope the agent actually needs, rather than at the subscription scope.; Reassigning role assignments to the new agentIdentityId whenever an agent moves from unpublished to published status.; Treating the shared project identity as having a broader blast radius and publishing agents that need tighter, separately audited access.

    • A. Correct. Scoping role assignments to the smallest resource or resource group needed follows least-privilege practice and limits blast radius.
    • B. Correct. Publishing creates a new distinct identity, so role assignments must be deliberately reassigned to keep access working under least privilege.
    • C. Incorrect. Granting a highly privileged role by default to every agent identity is the opposite of least privilege and expands blast radius unnecessarily.
    • D. Correct. Recognizing the shared identity's broader exposure and publishing agents that need tighter control is a documented practice for reducing risk.
    • E. Incorrect. Embedding a long-lived secret in a prompt bypasses RBAC entirely and creates a serious credential exposure risk.
    • F. Incorrect. Role assignments do not automatically carry over to a newly published agent's distinct identity, so skipping verification risks broken or stale access.

    Subdomain 4.2: Design and implement guardrails for multi-agent solutions

    31.A developer wants to test a stricter experimental content filter configuration against a small percentage of production traffic without changing the guardrail assigned to the model deployment itself. Which mechanism lets them apply a different guardrail for individual API calls?

    1. A.Send the guardrail name in the `x-policy-id` request header, which overrides the deployment-level guardrail for that specific call
    2. B.Modify the Microsoft.DefaultV2 guardrail directly, since it applies globally until a custom guardrail is created
    3. C.Add the experimental controls to the model deployment's guardrail permanently and roll them back after the test window
    4. D.Pass the guardrail configuration as a query parameter on the chat completions endpoint URL
    Show answer & explanation

    Correct answer: A — Send the guardrail name in the `x-policy-id` request header, which overrides the deployment-level guardrail for that specific call

    • A. Specifying a guardrail name in the `x-policy-id` request header applies that custom guardrail for just that API call, overriding the deployment-level configuration without touching the deployment's default assignment.
    • B. Microsoft.DefaultV2 is a Microsoft-managed guardrail that can't be edited, so it cannot be used as a vehicle for testing a custom experimental configuration.
    • C. Changing the deployment-level guardrail would affect all traffic through that deployment rather than just the small percentage the developer wants to test, and reverting it afterward is riskier than a per-request override.
    • D. Foundry's request-time guardrail override is implemented as a header value, not as a query parameter on the endpoint URL.

    Subdomain 4.2: Design and implement guardrails for multi-agent solutions

    32.A security architect is designing guardrail coverage for a mixed environment of model deployments and Foundry Agents. Which of the following are scoped specifically to agents rather than being available for model deployments? (Select all that apply.)(Select 3)

    1. A.User input scanning
    2. B.Tool call scanning (Preview)
    3. C.Tool response scanning (Preview)
    4. D.Output scanning
    5. E.Network egress controls (Preview)
    6. F.The Annotate-only response action
    Show answer & explanation

    Correct answers: B, C, E — Tool call scanning (Preview); Tool response scanning (Preview); Network egress controls (Preview)

    • A. User input scanning applies to both model deployments and agents, so it is not agent-specific.
    • B. Tool call scanning is documented as agent-only, since only agents propose actions and data to send to external tools, so this intervention point does not apply to models.
    • C. Tool response scanning is likewise agent-only, because only agents receive content back from tools that needs to be scanned before it re-enters the agent's reasoning.
    • D. Output scanning applies to both model deployments and agents, so it is not agent-specific.
    • E. Network egress controls govern outbound connections for hosted agents and apply only to agents, not to model deployments, making them agent-specific.
    • F. The Annotate-only action is the reverse case: it's supported for models but not available for agents, so it is scoped to models rather than being agent-specific.

    Subdomain 4.2: Design and implement guardrails for multi-agent solutions

    33.For Foundry Agent guardrails, the Annotate-only action is available as an alternative to Annotate and block.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. This statement is not accurate because the Annotate-only action is applicable to models but is not offered as an option for agents.
    • B. Agents only support the Annotate and block action; the Annotate-only action is limited to model deployments.

    Subdomain 4.3: Deploy multi-agent solutions to Azure

    34.After publishing a new version of a Foundry hosted agent to production, the team observes a spike in evaluation failures within minutes. They need to restore service immediately without waiting for a new build or redeployment pipeline run. Which built-in capability lets them do this fastest?

    1. A.Promote a previously published agent version back to the stable endpoint, since Foundry snapshots each version and keeps it available for rollback.
    2. B.Trigger a new CI/CD pipeline run that rebuilds the container image from the last good commit and redeploys it to the managed endpoint.
    3. C.Scale the hosted agent's container compute down to zero and back up, expecting the runtime to reload the prior configuration from cache.
    4. D.Edit `azure.yaml` to reference an earlier model deployment, then run `azd provision` to recreate the underlying Foundry resources.
    Show answer & explanation

    Correct answer: A — Promote a previously published agent version back to the stable endpoint, since Foundry snapshots each version and keeps it available for rollback.

    • A. Foundry automatically snapshots agent versions on publish, so promoting a prior version back to the stable endpoint restores known-good behavior without any rebuild, making it the fastest path.
    • B. Rebuilding a container image and running a full pipeline works eventually but takes far longer than promoting an already-published snapshot, so it does not meet the immediate-restore requirement.
    • C. Scaling compute down and back up restarts instances but does not change which agent version or instructions are active, so it will not revert the faulty change.
    • D. Changing the referenced model deployment only affects which model is used, not which agent code or instructions version is live, and re-provisioning infrastructure is slower than promoting a version.

    Subdomain 4.3: Deploy multi-agent solutions to Azure

    35.A statement about canary releases: a canary release strategy exposes one hundred percent of production traffic to the new agent version immediately after deployment, with no gradual traffic-percentage increase.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. This is not an accurate description of canary releases, which are specifically designed to avoid exposing all traffic immediately.
    • B. Canary releases gradually increase the traffic percentage on the new version in stages while monitoring for regressions, so exposing all traffic immediately with no ramp contradicts the definition of canary.

    Want the full experience?

    These are just samples. Practice the full Microsoft Azure Designing and Implementing Multi-Agent AI Solutions (AI-500) question bank in quiz mode — free, no signup, with domain practice and exam simulation.

    Practice all 357 questions in quiz mode