Free Google Cloud Professional Agentic Architect Sample Questions

Correct answer: B — Configure data federation so queries retrieve rows directly from BigQuery without copying them into an index.

• A. Data ingestion copies data into the index to improve search relevance and speed, which contradicts the requirement of not storing a copy inside Gemini Enterprise.
• B. Data federation retrieves information directly from BigQuery at query time without copying it into an index, matching the requirement for a live, uncopied view even at some cost to relevance.
• C. Mirroring the table into Cloud Storage before indexing still produces a stored copy of the data, defeating the goal of avoiding duplication, and adds unnecessary pipeline complexity.
• D. OCR parsing extracts text from scanned or image-based content and has no bearing on structured BigQuery rows, so it does not address the federation-versus-ingestion decision.

Correct answer: A — The Layout Parser, because it detects document hierarchy such as headings, tables, lists, and paragraphs, producing chunks that preserve structure.

• A. The Layout Parser is the parser designed to detect hierarchy elements like headings, tables, and lists, which directly supports structure-aware chunking and better answer generation.
• B. The Digital Parser extracts machine-readable text but does not detect structural elements like tables or headings, so it does not match the Layout Parser's hierarchy detection.
• C. The OCR Parser is intended for scanned pages or image-embedded text, not for already machine-readable, well-formatted office documents.
• D. The `useNativeText` merge behavior is associated with the OCR Parser combining scanned and native text, not with the Digital Parser adding hierarchy tags.

Correct answers: A, B, C — Use the Layout Parser for the DOCX policy manuals so headings and tables are detected for structure-aware chunking.; Use the OCR Parser for the scanned memos so text can be extracted from the non-searchable scanned pages.; Rely on image annotation and multimodal embeddings so the product photos become searchable through descriptions and semantic similarity.

• A. The Layout Parser's hierarchy detection is the right fit for born-digital DOCX files with headings and tables, preserving structure for better chunking.
• B. The OCR Parser is built for scanned pages lacking a machine-readable text layer, making it the correct choice for the scanned memos.
• C. Image annotation and multimodal embeddings together make photo content searchable, both through generated descriptions and through semantic similarity in a shared embedding space.
• D. The Digital Parser only extracts already machine-readable text and cannot read non-searchable scanned content, so it is not suited to the scanned memos.
• E. OCR is meant for scanned or image-embedded text; born-digital files are better served by the Layout Parser, which also detects structural elements OCR does not.
• F. Image content can be indexed through image annotation and multimodal embeddings, so skipping the photos entirely is unnecessary and discards usable content.

Correct answer: A — Set the route's intent to `confirm_order` and add a condition on `cart_total`, so both must hold together

• A. A transition route can require both an intent match and a condition at the same time, so it only triggers once both are satisfied together.
• B. Splitting the requirement into two independent routes lets either one fire on its own, which does not enforce that both conditions hold simultaneously.
• C. Conditions are a supported part of a transition route's own definition and do not need to be moved onto an event handler to be evaluated.
• D. Checking the condition only after the route has already fired means the transition happens before the requirement is actually verified.

Correct answer: A — It calls the flow via the DetectIntent API and stays inside that flow until it reaches END_SESSION

• A. A flow-based agent invokes the existing flow through the DetectIntent API and keeps the conversation inside that flow until the flow reaches END_SESSION.
• B. Merging the flow's routes into the calling agent's own canvas would defeat the purpose of reusing the flow as a self-contained unit.
• C. Turning the flow into per-turn tools would break its multi-turn state machine, which depends on staying inside the flow across turns.
• D. A prompt template describing intents is not the same mechanism as invoking an existing flow, and would not reproduce its exact routing logic.

Correct answer: A — Instruct the model to explain its reasoning before the final eligibility decision is given

• A. Asking the model to reason through the overlapping conditions step by step before deciding helps it work through unusual interactions more reliably than a single-shot answer.
• B. Examples that show only the final decision without reasoning don't help the model handle novel combinations of conditions it hasn't seen before.
• C. General historical background about refunds overall doesn't address the specific reasoning needed to resolve overlapping policy conditions.
• D. Shortening the instructions reduces guidance rather than improving reasoning, which works against handling a case that already needs more careful evaluation.

Correct answer: A — The personal plugin under the global plugins directory in the user's home folder, and the compliance plugin under the project's `.agents/plugins/` directory.

• A. Manual plugin installation supports a workspace-level location under the project's .agents/plugins/ directory and a global location under the user's home directory, so a cross-repo personal plugin belongs globally while a single-project compliance plugin belongs in that project's workspace directory.
• B. This reverses the intended scopes; placing the cross-repo personal plugin in one project's workspace directory would confine it to that project, and placing the single-project compliance plugin globally would leak it into every repository.
• C. There is no documented scope field inside plugin.json that changes where a plugin applies; placement is determined by which directory the plugin folder is staged in, not a manifest flag.
• D. A global, home-directory plugin location is documented alongside the workspace-level one, so treating everything as workspace-only would incorrectly force the cross-repo personal plugin into a single project.

Correct answer: A — `agy plugin import gemini`

• A. The Antigravity CLI documents `agy plugin import gemini` as the manual command that performs the same extension-to-plugin conversion offered by the interactive first-launch migration prompt, making it suitable for scripted setup.
• B. An export subcommand would push data out rather than pull existing Gemini CLI extensions in and convert them, which is the opposite direction of what the migration needs.
• C. agents-cli is a separate tool focused on building, evaluating, and deploying agents on Google Cloud; it is not the tool that performs Antigravity's plugin migration from Gemini CLI extensions.
• D. There is no documented `extension enable` subcommand for this purpose, and enabling extensions in place would not perform the conversion into Antigravity's plugin format.

Correct answer: A — Install `agents-cli` as skills for their existing coding agent, since it is designed to work with Claude Code, Codex, and Antigravity CLI alike.

• A. agents-cli is explicitly built to work seamlessly with multiple coding agents, including Claude Code, and can be installed as skills for the developer's existing coding agent rather than requiring a switch to a different tool.
• B. agents-cli documentation describes standalone CLI installation and an as-skills installation for other coding agents, so it is not gated behind uninstalling Claude Code and using Antigravity CLI instead.
• C. agents-cli is already documented as agent-agnostic tooling that plugs into several coding agents, so no Claude Code-specific fork is needed for it to function there.
• D. There is a supported installation path for using agents-cli alongside external coding agents, so manually vendoring ADK source code is unnecessary busywork rather than the documented approach.

Correct answer: A — Integration with Cloud Trace and logging as part of its observability skill module.

• A. agents-cli's documented skill modules include Cloud Trace and logging integration, letting a deployed agent's execution and errors feed into the same Google Cloud native observability stack the SRE team already relies on.
• B. agents-cli integrates with Cloud Trace rather than shipping a separate proprietary dashboard meant to replace it, so this would duplicate rather than reuse the SRE team's existing tooling.
• C. There is no manual spreadsheet-export step documented; the integration is with native Cloud Trace and logging services, not a manual data-transfer workaround.
• D. The documented integration is with Google Cloud's own Cloud Trace and logging, not a mandatory third-party observability vendor, so this does not match the tool's actual capability.

Correct answers: A, B, C — It uses gVisor, a user-space kernel that intercepts syscalls made by the sandboxed process.; It enforces a default network posture that blocks egress to the cloud metadata server.; It is built as an open, declarative Kubernetes primitive rather than a closed sandbox product.

• A. Correct: gVisor intercepts application syscalls in user space instead of passing them directly to the host kernel, which is exactly how Agent Sandbox achieves kernel-level isolation for untrusted code.
• B. Correct: the default network posture blocks egress to private ranges, cluster DNS, and the metadata server, limiting lateral movement and credential theft.
• C. Correct: Agent Sandbox is built as an open-source, declarative Kubernetes API under SIG Apps rather than a closed, vendor-specific isolation product.
• D. Incorrect: egress to the public internet is allowed by default; only private ranges, internal DNS, and the metadata server are blocked, so outbound internet access is not disabled entirely.
• E. Incorrect: gVisor's isolation is specifically about intercepting syscalls to shield the host kernel, not just limiting memory, so this understates the protection it provides.

Correct answer: A — To keep a human as the final gate before changes reach the shared remote.

• A. Withholding push access while still allowing read and test-run tools is a common safeguard that keeps a human in the loop as the final gate before agent-generated changes reach a shared remote, consistent with recommended review practices.
• B. MCP itself places no technical restriction on exposing version-control tools like push; servers exposing git operations exist, so this is not a protocol-level limitation.
• C. Running tests has no mechanism that globally disables git-related tools; tool availability is controlled by configuration, not as a side effect of running a test command.
• D. Token usage is driven by the size of prompts and responses, not by which categories of tools are enabled, so this does not explain deliberately excluding a push tool.

Correct answers: A, B, C — Administrators can centrally create, update, and manage a fleet from custom images.; A base image can be extended with pre-installed tools, extensions, and startup scripts.; Developers can reach their workstation remotely from different client devices.

• A. Correct: Cloud Workstations is designed for administrators to centrally provision, update, and manage developer environments at fleet scale from a shared custom image.
• B. Correct: a custom container image can extend a Cloud Workstations base image with pre-installed tools, IDE extensions, and startup automation, avoiding per-developer manual setup.
• C. Correct: because the workstation is hosted and managed centrally, developers connect to it remotely from whatever device they are using, rather than running it locally.
• D. Incorrect: gVisor-based, default-deny sandboxing for untrusted code execution is the defining property of GKE Agent Sandbox, not of Cloud Workstations, which focuses on persistent developer environments.
• E. Incorrect: the whole point of a managed, preconfigured or custom base image is that the OS and tooling are already installed, so developers do not perform manual OS setup themselves.

Correct answer: A — Routing every request through the large model first would multiply cost and latency without improving the final answer's quality

• A. Since the coordinator step is low-complexity routing that runs on every request, using the large model there would add unnecessary cost and latency while producing no improvement, because the final answer still comes from the sub-agent's own model call.
• B. Small models are commonly used precisely for coordinator or routing roles, so there is no technical barrier preventing their integration into this pattern.
• C. Tool-calling capability is not inherently tied to model size; the reason for using a small model at the routing stage is cost and latency, not a tool-calling limitation.
• D. There is no such restriction; proprietary and open-source models are routinely combined within the same workflow based on cost, security, and task fit.

Correct answer: A — ADK is an open-source framework that already provides tested primitives for agents, tools, sessions, and model integration

• A. ADK is an open-source, code-first framework that provides built-in, tested building blocks for agents, tools, sessions, and model integration, which is the practical reason to adopt it over building the same plumbing from scratch.
• B. Function calling and tool invocation are supported by many agent frameworks and directly by several model APIs; ADK is not the only way to achieve this.
• C. ADK supports Python and Java as first-class languages rather than a proprietary configuration language, so no such rewrite is required.
• D. Using a framework does not guarantee superior benchmark performance; agent quality still depends on the chosen model, instructions, and tool design.

Correct answer: A — The clarity and specificity of the natural-language instructions configured on the agent

• A. When tools function correctly but the agent disregards intended persona or constraints, vague or underspecified instructions are the most common cause and the first place to look.
• B. Data center geography affects latency and compliance, not whether the model follows the persona and constraints written into its instructions.
• C. The programming language used to implement a tool function has no bearing on whether the model follows its configured instructions.
• D. The session service implementation affects conversation persistence across turns, not whether the model adheres to its instructions within a given turn.

Correct answer: A — Chunk at each numbered step boundary with a small overlap of a sentence or two into the adjacent step

• A. Aligning chunk boundaries with the natural step structure keeps each chunk focused on one procedure, while a small overlap preserves just enough context to avoid losing a step's opening or closing sentence.
• B. Chapter-sized chunks bundle many unrelated steps into a single retrieval unit, which works against the stated requirement to keep answers scoped to a single step.
• C. A large fixed token count ignores where steps actually begin and end, so a single chunk can straddle two unrelated procedures and dilute the embedding's meaning.
• D. Plain paragraph splitting with no overlap and no structural awareness risks cutting a step across chunk boundaries, losing context exactly where the step continues in the next paragraph.

Correct answer: A — 3-legged OAuth for the calendar agent acting on the user's behalf, and 2-legged OAuth for the unattended maintenance agent

• A. 3-legged OAuth is designed for a scenario where an agent acts on behalf of a specific user, matching the calendar agent, while 2-legged OAuth lets an agent act under its own authority, matching an unattended nightly job.
• B. This reverses the two patterns: acting on behalf of a specific end user calls for delegated (3-legged) authorization, not the agent's own authority, and an unattended job has no user session to delegate from.
• C. Not every agent action requires end-user delegation; an unattended scheduled job with no human present has no user session to obtain 3-legged consent from.
• D. Agent identity can represent delegated user permissions when needed, and the calendar scenario specifically requires acting within an end user's own access, which 2-legged OAuth does not provide.

Correct answer: A — A centralized catalog for storing, discovering, and governing MCP servers, tools, skills, and agents

• A. Agent Registry is a centralized catalog where MCP servers, tools, standalone skills, and agents can be stored, discovered, and governed, letting teams reuse existing capabilities across the organization.
• B. Agent Registry is a catalog and governance system for agentic capabilities, not a billing tool focused on tracking compute spend.
• C. Agent Registry is a platform-level catalog service, not an inline code-editing or autocomplete tool for writing agent instructions.
• D. Agent Registry's purpose is discovery and governance of agentic capabilities, not uptime monitoring of deployed endpoints.

Correct answer: A — It follows a SPIFFE-based URI such as `principal://TRUST_DOMAIN/NAMESPACE/AGENT_NAME`, uniquely identifying the agent's runtime principal

• A. Agent Identity issues each agent a SPIFFE-standard principal URI in this trust-domain and namespace format, giving every agent a unique, system-attested runtime identity.
• B. A per-agent Agent Identity is distinct from a traditional shared service account email, which is exactly the shared-credential pattern Agent Identity is meant to replace.
• C. The identity is a persistent, system-attested principal bound to the runtime environment through certificate binding, not a bearer token regenerated with no runtime binding on every call.
• D. Agent Identity is system-issued and tied to the agent's lifecycle rather than a manually assigned and rotated API key managed through the console.

Correct answers: A, B, E — Setting `max_iterations` on the `LoopAgent` so the loop stops after a bounded number of passes even without approval; Having the review sub-agent signal an exit condition when the content is approved, ending the loop early; Combining a bounded `max_iterations` value with an explicit approval-triggered exit condition

• A. Correct: setting `max_iterations` gives the loop a hard cap so it stops after a bounded number of passes even if approval never happens, addressing the runaway-loop concern.
• B. Correct: an explicit exit condition triggered by the reviewer's approval lets the loop end early as soon as the content passes, rather than always running to the iteration cap.
• C. Incorrect: relying only on plain text output with no explicit exit signal or iteration cap gives the loop no reliable way to detect approval or bound its execution.
• D. Incorrect: running iterations simultaneously breaks the dependency between a revision and the review that follows it, since each iteration needs the prior iteration's revised content to review.
• E. Correct: combining a bounded iteration cap with an explicit approval-triggered exit condition satisfies both stated requirements, stopping on approval or on hitting the limit.

Correct answers: A, B, E — The bursty chat agent benefits from Agent Runtime's sub-second cold-start support to avoid latency spikes; The multi-hour batch agent benefits from Agent Runtime's support for long-running agent execution; Both agents can be deployed to the same managed execution environment that Agent Runtime provides

• A. Correct: sub-second cold starts are exactly the feature that helps a bursty chat agent respond quickly without latency spikes when new instances are needed.
• B. Correct: Agent Runtime's support for long-running agents accommodates the multi-hour batch job that stays active beyond a typical request-response cycle.
• C. Incorrect: neither agent needs to be restructured as a `LoopAgent`, since that is an ADK workflow composition pattern, not a deployment requirement of Agent Runtime.
• D. Incorrect: Agent Runtime explicitly supports long-running agents that execute beyond a single request-response cycle, so this statement contradicts its stated capabilities.
• E. Correct: Agent Runtime provides a single managed execution environment capable of hosting both short bursty agents and long-running agents.

Correct answers: A, B, E — A2A enables the coordinator agent to delegate a subtask to an independently deployed partner agent and receive its result; MCP enables an agent to call an internal enterprise tool or data source through a standardized interface; Both protocols can be used within the same system, since one addresses agent-to-agent interaction and the other addresses agent-to-tool interaction

• A. Correct: A2A is the protocol for agent-to-agent interoperability, letting a coordinator delegate a subtask to an independently deployed partner agent and receive the result back.
• B. Correct: MCP standardizes how an agent calls tools and data sources, which fits an agent invoking an internal enterprise tool through a consistent interface.
• C. Incorrect: A2A is a communication protocol between agents, not an IAM authentication mechanism; identity and authentication are handled by Agent Identity and Google Cloud IAM, not by A2A itself.
• D. Incorrect: handing conversations off between independently deployed agents is the role of A2A, not MCP, which is scoped to agent-to-tool access instead.
• E. Correct: the two protocols address different concerns, agent-to-agent versus agent-to-tool, so a system can and often does use both together.

Correct answer: A — The agent is stuck in a reasoning loop; inspect the execution trace to see why the model keeps re-issuing the same tool call instead of terminating

• A. Repeated near-identical tool calls without reaching a final answer is the classic signature of a reasoning loop, and the trace of the execution path shows exactly why the model is not recognizing that the loop condition has been satisfied.
• B. Jumping straight to a provider failover assumes an outage without evidence, and repeated identical calls with responses returning normally is more consistent with a loop in the agent's own reasoning than a downstream outage.
• C. Rolling back the model without checking the trace first is a premature action; the repeated tool calls pattern needs to be confirmed as loop behavior before attributing it to a version change.
• D. Disabling the tool addresses a symptom, not the cause, and removing the tool entirely could break agent functionality for other conversations without fixing the underlying loop condition.

Correct answer: A — It lets teams systematically detect regressions and quality issues in production and feed findings back into refinements

• A. The continuous loop connects live monitoring and tracing to evaluation and refinement, giving teams a systematic way to catch quality regressions in production and turn those findings into concrete prompt, tool, or model improvements.
• B. Production monitoring complements but does not replace pre-launch evaluation, since some issues are far cheaper and safer to catch against a curated dataset before real users are exposed to them.
• C. The loop surfaces findings for engineers to act on; it does not autonomously rewrite source code without review, which would remove necessary human oversight over changes.
• D. Having a monitoring and refinement loop in place helps detect and respond to drift faster, but it does not guarantee drift will never occur in the first place.

Correct answer: A — Continuous online evaluation against live traffic, which would have flagged the quality decline shortly after the model swap occurred

• A. Continuous online evaluation samples and scores live traffic on an ongoing basis, so it would surface the quality decline shortly after the silent model swap rather than weeks later.
• B. A one-time pre-launch report reflects conditions before launch and cannot account for a model change that happens afterward, so it would not catch this issue at all.
• C. Waiting for user complaints is a lagging and incomplete signal, since many users experiencing a subtle quality drop will not bother to report it, delaying detection far beyond two weeks.
• D. Spot-checking only five conversations per quarter is too infrequent and too small a sample to reliably catch a subtle quality shift shortly after it begins.

Correct answer: A — A user's only matching itinerary requires an uncommon currency-conversion tool call before final pricing

• A. Requiring an uncommon tool combination, such as invoking currency conversion before pricing, is exactly the kind of low-frequency, multi-tool interaction that typical traffic rarely exercises, making it a strong edge case.
• B. A one-way booking between major cities on a common date is a mainstream, high-frequency request pattern, so it represents typical behavior rather than an edge case worth singling out.
• C. Checking the weather at a destination is a routine, single-tool lookup that the agent is expected to handle constantly, making it representative traffic rather than an edge case.
• D. Listing popular airlines on a common route is a simple, frequent informational query with low complexity, so it fits typical usage rather than an unusual failure-prone scenario.

Correct answer: A — `tool_trajectory_avg_score`

• A. `tool_trajectory_avg_score` computes an exact-match comparison of the actual tool call sequence against the expected sequence, which is precisely the fraction-matching behavior described.
• B. `response_match_score` measures textual similarity between the final natural-language response and the expected response using ROUGE-1, not the tool call sequence.
• C. `hallucinations_v1` is an LLM-based metric that flags unsupported or fabricated claims in the response, unrelated to comparing tool call sequences.
• D. `safety_v1` is an LLM-based metric that screens output content for policy violations, not for whether tool calls match an expected trajectory.

Correct answer: A — ADK evaluation tooling is framework-native, built for fast local or CI iteration, while the Gen AI evaluation service is a managed platform capability

• A. ADK's evaluation tooling is built into the framework for fast local and CI-driven iteration, while the Gen AI evaluation service is a managed platform capability that extends to broader scenarios like online evaluation of live production traffic, which correctly captures their distinct roles.
• B. ADK's test files and evalsets are designed for use during development, well before any deployment, so restricting ADK tooling to post-deployment use reverses its actual purpose.
• C. The evaluation service is designed to work across agent implementations, including those built with ADK, since it evaluates based on datasets and inference outputs rather than being restricted to a single framework.
• D. The two are separate offerings with different scopes, one framework-native and one a managed cloud service, so treating them as identical implementations ignores their documented differences in scale and integration.

Correct answer: A — Cryptographically bound tokens tied to an auto-provisioned per-agent certificate, with no exportable service account keys

• A. Agent Identity issues each agent a unique certificate and cryptographically binds its access tokens to that certificate, so no persistent key file exists to leak and a stolen token cannot be replayed elsewhere without the matching private key.
• B. A shared service account can still generate long-lived keys and does not bind tokens to a specific machine, so a leaked key or token remains replayable and manual rotation leaves a long exposure window.
• C. A single shared API key is itself a long-lived credential distributed to many agents, which is the opposite of eliminating persistent keys and offers no per-agent token binding.
• D. Environment-variable basic auth credentials are static secrets that can be copied and reused from any host, so they do not prevent replay of a stolen credential.

Correct answer: A — It denies the traffic, since the gateway only allows traffic for resources explicitly authorized via IAM

• A. Agent Gateway's default posture is to allow traffic only for resources explicitly authorized through IAM, so any unregistered or unauthorized destination is denied rather than passed through.
• B. There is no default one-time allowance followed by retroactive approval; unauthorized destinations are blocked by default rather than let through temporarily.
• C. The gateway's default behavior is to deny unauthorized traffic outright, not to downgrade the payload and still deliver it.
• D. Model Armor screening addresses content safety for authorized traffic; it is not the mechanism that determines whether an unauthorized destination is reachable in the first place, and unauthorized traffic is blocked before this would matter.

Correct answer: A — Agent Identity provides each agent's unique, cryptographically bound principal; Model Armor screens prompt and response content for injection and unsafe material

• A. Agent Identity's core role is issuing a unique, certificate-bound principal per agent, while Model Armor's core role is screening prompts and responses for injection, jailbreak, and unsafe content, matching each component to its actual documented purpose.
• B. This swaps the two components' responsibilities: Agent Gateway, not Agent Registry, enforces network-layer traffic policy, and Agent Registry, not Agent Identity, catalogs discoverable tools.
• C. This swaps certificate issuance and injection detection: Agent Identity issues certificates for token binding, and Model Armor, not Agent Gateway, is the component that detects prompt injection content.
• D. This swaps the inventory and dashboard roles: Agent Registry, not Agent Gateway, stores the MCP server inventory, and Agent Gateway, not Principal Access Boundary, generates the observability dashboards.

Correct answer: A — Identity-Aware Proxy (IAP)

• A. Identity-Aware Proxy is the default enforcement layer on Agent Gateway, validating the requesting agent's identity and checking its assigned permissions before the traffic is allowed to proceed.
• B. Cloud Armor provides network-layer protections like DDoS mitigation and WAF rules for internet-facing services, but it is not the identity-validation enforcement layer built into Agent Gateway.
• C. VPC Service Controls create data exfiltration perimeters around Google Cloud resources at the network boundary, which is a different control from the per-request identity and permission checks Agent Gateway performs by default.
• D. Binary Authorization attests to and controls which container images are allowed to deploy to a runtime, which happens at deployment time rather than validating agent identity on live request traffic.

Correct answer: A — RunState persistence, which snapshots the conversation and memory, hibernates the agent, and resumes it once human input arrives

• A. RunState persistence snapshots the environment, hibernates the agent so it consumes no active compute while waiting, and resumes it seamlessly once the human provides input, which is exactly the durable, resource-efficient pause the team needs.
• B. Pinning a compute instance to the conversation for days would keep that instance actively reserved and running the entire time, which contradicts the goal of not keeping compute active while waiting for approval.
• C. Repeatedly polling an approval endpoint keeps a process actively running to perform each check, which still consumes compute over the multi-day wait rather than hibernating between the pause and the eventual human response.
• D. Keeping state only in a process's RAM is fragile and non-durable; if that process is ever restarted or reclaimed during a multi-day wait, the conversation state would be lost rather than reliably resumed.

Correct answers: A, B, C — Incoming user prompts, screened for jailbreak, injection, and unsafe content before reaching the model; Model-generated responses, screened before they are delivered back to the requesting user; Uploaded documents such as PDFs, Word files, spreadsheets, and CSVs passed into the agent's context

• A. Model Armor inspects incoming user prompts for jailbreak attempts, prompt injection, and other unsafe content before that prompt ever reaches the underlying model.
• B. Model Armor also screens model-generated responses before they are delivered to the requesting user, catching unsafe or policy-violating output on the way out, not just on the way in.
• C. Model Armor can screen uploaded documents such as PDFs, Word documents, spreadsheets, and CSV files that get passed into an agent's context, extending screening beyond plain text prompts.
• D. Encrypted VPN tunnel traffic for general corporate networking is a network-security concern handled by dedicated networking and VPN security tooling, not by Model Armor, which is scoped to LLM prompt, response, and document content.
• E. Inspecting raw packet flows at the network layer across a data center is the domain of network intrusion detection systems, not Model Armor, which operates on the semantic content of prompts, responses, and documents rather than packet-level traffic.
• F. Scanning container image layers for vulnerabilities is a software supply-chain security function performed by tools like Artifact Analysis, unrelated to Model Armor's role of screening LLM prompt and response content.