Free Palantir AI Engineer Associate Sample Questions

Correct answer: A — Struct

• A. A struct output lets the developer define a composite of named, typed fields such as carrier name, tracking number, and delivery date, bundling related values into a single structured result.
• B. An array is a homogeneous, ordered collection of values of one type and does not naturally represent three differently-typed named fields grouped together.
• C. An object list represents a collection of Ontology objects, which is not appropriate here since the shipment fields are not references to existing Ontology object instances.
• D. A boolean output can only represent a true or false value, which cannot capture carrier name, tracking number, and delivery date together.

Correct answer: C — Split the task into multiple Use LLM blocks so the model performs one step per call and can use tools between steps

• A. Raising temperature makes completions more varied, not more consistent, so it would make a multi-step task less reliable rather than fixing the skipped validation step. It does nothing to address the underlying problem of asking one prompt to reliably complete several distinct steps.
• B. Reordering or consolidating the instructions inside the same single-shot prompt does not give the model a way to verify its own intermediate work between steps. The extraction and validation steps still happen inside one uninterrupted completion, so the same inconsistency is likely to persist.
• C. Breaking a multi-step task into separate blocks lets the model complete and, where needed, use tools for one step at a time, which is the recommended response when a single completion produces inconsistent results on multi-step work. Each smaller call has a narrower job, making it easier for the model to complete reliably.
• D. Forcing prompted tool calling over native tool calling changes how tool invocations are formatted internally but is not a mechanism for improving multi-step reliability, and it is not something an author manually selects to slow a response down. It does not address the root cause of inconsistent multi-step outputs.

Correct answer: A — The current version of the function becomes available to be called by consumers such as actions or Workshop, separate from the draft still being edited.

• A. Publishing makes the current version usable by downstream consumers like actions and Workshop applications, while further edits can continue on the function separately.
• B. Publishing does not permanently lock the function from future edits; developers continue iterating and can publish new versions afterward.
• C. Publishing keeps the function within AIP Logic itself; it does not convert or migrate the logic into a Code Repository.
• D. Publishing a Logic function does not trigger a re-index of the Ontology object types it references; indexing is unrelated to the publish action.

Correct answer: A — Semantic versioning in the form major.minor.patch, such as 2.1.0

• A. Function releases use semantic versioning, incrementing the major number for breaking changes, the minor number for backward-compatible additions, and the patch number for backward-compatible fixes.
• B. Version numbers are chosen deliberately by the publisher to reflect compatibility, not assigned automatically as a running save counter.
• C. Version strings are not derived from publication timestamps; they follow the major.minor.patch structure that communicates compatibility.
• D. Version numbers are ordered and meaningful, since consumers rely on their sequence to reason about compatibility, so a random identifier scheme would not fit.

Correct answer: A — The chatbot is permissioned down to the filesystem location where it and its content are saved, and the user lacks access to that backing content.

• A. Chatbots and their content are permissioned down to the filesystem location where they are saved, so a user without access to that location can see the chatbot but cannot retrieve answers from its backing content.
• B. AIP Assist chatbots can use Notepad documents and in-platform Markdown as knowledge sources, so this is not a general limitation and does not explain the behavior.
• C. Publishing a Chatbot as a Function extends where it can be invoked but does not remove its conversational availability within AIP Assist, so this does not explain the failure.
• D. Model selection preferences affect which LLM answers a conversation, not whether the user can access the chatbot's permissioned backing content, so this does not explain the failure.

Correct answer: A — Ontology context can use a static object set, a variable subset from application state, or semantic search over vector-embedded object types.

• A. Ontology context supports a static input of a fixed object set, a variable input drawn from application state, and semantic search when the object type has vector embeddings, letting a team pick the retrieval style that fits the use case.
• B. There is no mode that forces every object of a type to be sent unfiltered; static input still limits the object set, and semantic search returns only the most relevant matches.
• C. A custom Function is only needed for Function-backed context, which exists precisely for cases the built-in Ontology and Document context options cannot handle; Ontology context itself does not depend on it.
• D. Ontology context and Document context are independent retrieval configurations, and enabling one is not a prerequisite for using the other.

Correct answer: D — The Debug application state section in AIP Chatbot Studio, which allows manual testing of variable values before deployment.

• A. The Workshop variable mapping panel only becomes relevant once the chatbot is embedded in a Workshop application, which conflicts with the requirement to test before embedding.
• B. Automate effect settings configure scheduling and ordering for automation effects, not manual testing of a chatbot's application state variables inside AIP Chatbot Studio.
• C. The AIP Evals metrics dashboard compares results across completed evaluation runs rather than letting an engineer manually set variable values before any deployment.
• D. The Debug application state section in AIP Chatbot Studio is built for manually setting variable values and observing chatbot behavior directly, before the chatbot is embedded or deployed anywhere.

Correct answer: A — Turning user corrections or downstream outcomes observed after deployment into new evaluation cases or priorities.

• A. A feedback loop converts real user corrections and observed outcomes into new evaluation cases or priorities, keeping the test suite representative of how the agent actually performs after release.
• B. Feedback loops do not involve automatically retraining the foundation model from a single lower score; they feed observations into evaluation and improvement work rather than triggering retraining.
• C. Re-running the same test case until it passes would mask real issues rather than turning genuine user corrections into new, meaningful test coverage.
• D. Replaying a conversation back to the same user for agreement is not how a feedback loop is used; it is about converting observed corrections and outcomes into new test cases, not re-confirming a single answer.

Correct answer: A — text-embedding-ada-002

• A. text-embedding-ada-002 is the Palantir-provided embedding model used to convert text into vectors for semantic search.
• B. gpt-4o is a general-purpose chat and reasoning model, not the embedding model Palantir provides for vectorizing text.
• C. claude-3-opus is a conversational LLM used for generation tasks, not the embedding model used in Foundry's semantic search workflow.
• D. llama-3-70b is a general-purpose language model, not the text embedding model Palantir provides for semantic search.

Correct answers: A, B, F — The KNN search call may fail outright because the query vector's dimension does not match the dimension configured on the vector property.; Even if a similarity score is returned, it will not reflect genuine semantic closeness, since the two models encode meaning differently.; Downstream evaluation metrics for the RAG pipeline, such as retrieval precision, are likely to drop even though the pipeline runs without errors.

• A. This is a plausible outcome: vector properties are configured with a fixed Dimension matching the indexing model's output, so a query vector of a different size can be rejected or error out before similarity can even be computed.
• B. This is plausible: even in the rare case dimensions happen to align, two independently trained models encode meaning differently, so any similarity score produced is not a valid measure of semantic closeness.
• C. Foundry does not fall back to keyword matching when a vector dimension mismatch occurs; the search mechanism remains vector-based and either errors or produces unreliable scores rather than switching search strategies.
• D. Foundry does not silently zero-pad mismatched vectors to force a result set; this kind of automatic reconciliation is not part of how vector properties or KNN search behave.
• E. The Similarity Function on a vector property is a fixed configuration set by the engineer, not something that changes automatically based on which models happen to be used at query versus index time.
• F. This is plausible: precision, recall, and other retrieval metrics measure whether the right documents surface for a query, and mismatched embedding spaces predictably surface less relevant documents even when no runtime error occurs.

Correct answer: A — It has the LLM generate a hypothetical answer to the query first, then embeds that generated text and uses it to search for similar real documents.

• A. HyDE works by asking the LLM to draft a plausible answer to the query even before retrieval, then embedding that hypothetical answer instead of the raw query. Because the hypothetical answer resembles the style and content of a real document more closely than a short question does, it often matches relevant documents more effectively.
• B. Averaging embeddings from multiple query rewrites describes a query-expansion or query-augmentation approach, not HyDE, which relies on generating a single hypothetical document rather than blending multiple query variants.
• C. Merging keyword and semantic search rankings with reciprocal rank fusion describes hybrid search, a separate technique from HyDE that combines two independent retrieval methods rather than generating a hypothetical answer.
• D. Scheduled re-embedding of an object set is a freshness or index-maintenance concern unrelated to HyDE, which operates on individual queries at search time rather than on the underlying index's refresh cadence.

Correct answer: A — Chunking strategy

• A. Correct. Oversized chunks pack multiple unrelated topics together, so even when the right chunk is retrieved, the model has to sort out the target fact from surrounding noise, which increases the odds of blending in wrong details. Reducing chunk size or adding chunk overlap that isolates topics would directly address this.
• B. Incorrect. The described symptom is topic-area retrieval succeeding but fact-level precision failing within an already-retrieved chunk, which is not explained by which embedding model produced the vectors. An embedding mismatch would more typically cause the wrong topic area to be retrieved altogether.
• C. Incorrect. The threshold controls whether a candidate is included in results at all; here the right topic-area chunk is already being returned, so the cutoff is not the limiting factor. A threshold problem would more likely show up as too few or too many results, not blended details within a returned chunk.
• D. Incorrect. The prompt template controls how retrieved context is presented to the model, but the root issue here is that the retrieved chunk itself contains unrelated paragraphs mixed with the target fact. Fixing the template would not remove the unrelated content from the chunk.

Correct answer: A — Generation step

• A. Correct. Since the correct passage was retrieved, ranked highly, and confirmed present in the prompt, the failure occurs after retrieval succeeded, meaning the model is not properly grounding its answer in the supplied context. This points to the generation step, such as prompt instructions or the model's tendency to rely on its own training data over provided context.
• B. Incorrect. The chunk containing the correct answer was retrieved intact and verbatim, so the way the document was segmented into chunks is already working correctly for this query. A chunking issue would more likely manifest as the fact being split or missing from the retrieved chunk.
• C. Incorrect. The dimension setting only affects whether embeddings can be computed and compared at all; a mismatch here would typically prevent retrieval from working rather than allow the correct chunk to be ranked first. Since retrieval clearly succeeded, dimension configuration is not implicated.
• D. Incorrect. The correct chunk was not just included but ranked at the top, which means it comfortably passed whatever threshold is configured. A threshold problem would show up as the correct chunk being excluded, not as the model ignoring content it already received.

Correct answers: A, B, C — Extracting mentioned product names and defect types into typed fields; Classifying each review as positive, neutral, or negative sentiment; Summarizing long free-text reviews into a short one-sentence synopsis

• A. Entity extraction into typed fields, such as product names and defect types, is a core supported use of the Use LLM node when a struct output type is configured.
• B. Sentiment classification of each review into predefined categories is one of the standard batch tasks the Use LLM node is designed to perform at scale.
• C. Summarizing long review text into a shorter synopsis is another standard batch task supported by the Use LLM node for condensing content.
• D. Multi-turn conversational chat with individual users is an interactive, session-based capability handled by AIP Agents or Chatbot Studio, not by a batch pipeline node.
• E. Executing arbitrary end-user-submitted SQL against the warehouse is a data access and security concern unrelated to the LLM node's batch text-processing purpose.
• F. Editing live object data is performed through Ontology actions, not through a batch pipeline node whose job is to enrich rows with derived text-processing outputs.

Correct answer: C — Export service logs, including prompts and token usage, to a Foundry streaming dataset for downstream analysis

• A. Rate limits govern how many requests per minute a model can handle; raising them does not extend how long execution records are retained in run history.
• B. Trial run results from a Use LLM node are a sample-row preview used during pipeline authoring, not a mechanism for long-term, year-spanning telemetry analysis.
• C. Exporting service logs, which include prompts and token usage, to a Foundry streaming dataset lets a team run arbitrary long-range analysis and correlate volume with cost trends far beyond the built-in retention window.
• D. Georestriction settings control where models and data can be processed for regional compliance; they do not extend log retention or enable custom telemetry analysis.

Correct answer: C — Because the result reflects session-specific context and would be stale or wrong if reused by other consumers

• A. AIP Logic functions can perform Ontology edits and write to properties, so an outright inability to write is not accurate; the concern with north-of-Ontology output is reuse, not a technical write restriction.
• B. Pipeline Builder is not the only path for writing to the Ontology; Logic actions and Code Repository transforms can also write properties, so this overstates Pipeline Builder's exclusivity.
• C. Interactive reasoning depends on context available only during that specific session or query, so caching it as a shared property would surface one user's transient context to every other consumer as if it were a general, durable fact.
• D. Persisted properties can be produced by any south-of-Ontology mechanism, including Pipeline Builder nodes, not exclusively by Code Repository transforms, so this claim is too narrow.

Correct answers: A, B, C — The job must run on a recurring nightly schedule with custom retry and exponential backoff logic when the upstream API returns rate-limit errors.; The workflow needs a third-party Python library, such as a specialized NLP toolkit, that is not exposed as a Pipeline Builder node.; The job must implement programmatic control flow, such as branching on intermediate LLM output and issuing follow-up calls conditionally.

• A. Custom retry and exponential backoff logic in response to rate-limit errors is exactly the kind of programmatic rate-limiting control that requires writing code in a Code Repository rather than configuring a low-code node.
• B. A third-party Python library not exposed as a Pipeline Builder node can only be brought into the workflow through a Code Repository's dependency management, so this justifies the migration.
• C. Conditional branching on intermediate output with follow-up calls is programmatic control flow that a Code Repository transform can express in code, unlike a fixed configuration node.
• D. A single pass with no scheduling, throttling, or external dependency needs is precisely the simple case the Use LLM node already handles well, so it does not justify moving to a Code Repository.
• E. Previewing output on a small sample of rows is the trial run feature already built into Pipeline Builder, so it is not a reason to migrate the workflow into code.
• F. Producing structured, typed output such as arrays or entity properties is a native configuration option of the Use LLM node, so needing only that does not require moving to a Code Repository.

Correct answer: A — Generate test cases from the object set of historical tickets and also add manually defined test cases in the same suite

• A. AIP Evals supports generating test cases from an object set, where each object becomes a test case, and this can be combined with manually added test cases in the same suite, which covers both scale and hand-crafted edge cases.
• B. Manually defining a test case per historical ticket would work for a handful of cases but does not scale to thousands of records and ignores the object-set generation feature built for exactly this purpose.
• C. Target functions are the functions under evaluation; pointing a target function at the object set directly bypasses the test case and evaluator structure that AIP Evals relies on to compare actual versus expected output.
• D. Evaluators compare actual output to expected output that must already be defined in a test case; they do not generate expected labels from the classifier's own predictions, which would make the comparison meaningless.

Correct answer: C — Adversarial case

• A. A normal case represents typical, everyday interactions the function is expected to handle in production, not a deliberate attempt to subvert its instructions.
• B. An edge case probes boundary or unusual but legitimate inputs, such as empty fields or maximum-length values, rather than a manipulation attempt.
• C. Prompts crafted to override a function's instructions and extract hidden configuration are a textbook adversarial input, so this category directly matches the scenario.
• D. A high-consequence case concerns actions with severe or hard-to-reverse impact, such as financial transfers, which is a different concern from instruction-override attempts.

Correct answer: C — Run each test case at least three times and aggregate the results before drawing conclusions

• A. Turning off the evaluator removes the only signal available for judging quality and does not address the underlying non-determinism, so it leaves the team unable to detect real problems.
• B. Loosening the passing threshold just masks fluctuating scores rather than establishing whether the underlying performance is actually stable across runs.
• C. Because LLM-backed functions are non-deterministic, running each test case multiple times and aggregating the outcomes is the recommended way to get a dependable read on performance rather than reacting to one noisy run.
• D. A single run cannot separate ordinary run-to-run fluctuation from an actual change in behavior, so treating one failure as a confirmed regression risks chasing noise.

Correct answers: A, B, C — Run the suite multiple times and compare the metrics dashboard across those runs before drawing a conclusion.; Compare aggregate results across runs on the same test cases for both the prior and updated model versions.; Use the test case debug view to inspect specific inputs and outputs where the metric changed.

• A. Running the suite multiple times and comparing results across those runs helps reveal whether a metric change is consistent or just noise from a single run, which is essential for telling variance apart from a real regression. A single data point cannot distinguish the two.
• B. Comparing aggregate results across runs for both the prior and updated versions on identical test cases isolates the effect of the model change from run-to-run noise. This side-by-side comparison is the direct way to detect a genuine regression.
• C. Inspecting specific inputs and outputs where the metric changed helps confirm whether the drop reflects a real behavioral change in the target function or an isolated scoring quirk. This case-level detail complements the aggregate comparison.
• D. Drawing a conclusion from a single run ignores the possibility that the drop was caused by non-deterministic variance rather than an actual change in the target function's behavior. One run is not enough evidence to distinguish the two causes.
• E. Skipping investigation entirely risks missing a genuine regression introduced by the model update, since the drop could just as easily reflect a real problem as ordinary variance. The scenario calls for determining which cause it is, not assuming an answer.

Correct answer: D — Effects execute sequentially by default, and parallel execution must be explicitly enabled

• A. Correct. Automate runs configured action, logic, and function effects in parallel by default; sequential ordering is an opt-in setting that requires at least two of these effect types.
• B. Incorrect. The order in which effects were added to the automation's configuration does not determine execution order when running in the default parallel mode.
• C. Incorrect. No effect type is inherently prioritized ahead of another by default; ordering across action, function, and logic effects only exists when sequential execution is explicitly configured.
• D. Incorrect. This reverses the actual default; parallel execution is the out-of-the-box behavior, and sequential ordering is the setting that must be turned on.

Correct answer: A — They execute in parallel and independently, so one effect's failure does not block or impact the others

• A. Correct: by default, effects run concurrently and independently, so a failure in one effect does not impact whether the other configured effects run.
• B. Incorrect: sequential ordering with earlier-effect-failure blocking later effects only applies when sequential execution has been explicitly configured, which requires at least two ordered effects; it is not the default behavior.
• C. Incorrect: there is no reverse-creation-order default, and fallback effects handle failure of a specific action effect rather than reordering the whole effect list.
• D. Incorrect: retry policies such as backoff and jitter are configured per effect, not pooled into one shared budget across every effect in the automation.

Correct answer: A — The action effect stops functioning, because actions are associated with the automation's owner and execute on that owner's behalf

• A. Correct: actions are associated with the owner of an automation and run on that owner's behalf, so a disabled or deleted owner account causes action effects to cease functioning since submission criteria can no longer be satisfied.
• B. Incorrect: there is no automatic reassignment of ownership to another editor when the original owner's account is disabled; ownership must be handled explicitly rather than transferring silently.
• C. Incorrect: action effects run under the specific owner's identity and permissions, not a generic shared service account, so there is no built-in fallback identity to keep the effect running.
• D. Incorrect: submissions require the owner to satisfy the action's criteria at execution time, so a disabled account blocks new submissions entirely rather than merely suspending retry scheduling.

Correct answer: A — The automation's event history, which provides flame charts of execution flow along with service logs showing token usage, errors, and traces

• A. Correct: an automation's event history surfaces flame charts of the execution flow together with service logs covering token usage, errors, and traces, which is exactly what is needed to diagnose a failed object and unexpected model calls.
• B. An object type's edit history tracks property changes on objects but does not expose execution flow, token usage, or trace-level detail about how a specific automation run behaved.
• C. The resource permissions page describes who can access the automation, not what happened during a specific execution or why an object failed.
• D. The pipeline build monitor tracks dataset transform builds and is unrelated to inspecting the execution flow or logs of an automation's manual run.

Correct answers: B, D, F — Automatic per-effect retries are configured individually on action or Logic effects and target transient errors, such as AIP model rate-limit errors; Manual retries can be issued for a paused automation to reattempt events that previously failed due to a configuration problem that has since been fixed; Automatic per-effect retries and event retries can both be in play for the same automation, since they address different failure scenarios

• A. Event retries reattempt the entire trigger event across all affected objects, not a single isolated effect, which distinguishes them from automatic per-effect retries.
• B. Automatic per-effect retries live on the individual action or Logic effect configuration and are meant to absorb transient issues like AIP model rate limiting without any manual intervention.
• C. Manually retrying a paused automation's failed events does not require deleting the automation; the automation is paused, not removed, while the configuration issue is addressed.
• D. Manual retry exists for automations that have been paused, letting a team fix an underlying configuration problem and then reattempt the events that failed because of it.
• E. A fallback effect is a separate effect that runs once an object's primary effect has failed and exhausted its retries; it is not itself a retry of the original effect with different parameters.
• F. Automatic per-effect retries handle transient failures within a single effect's execution, while event retries handle reattempting the trigger event as a whole, so both mechanisms can coexist and apply to different failure scenarios in the same automation.

Correct answers: A, B, C — Whether the model is available in the enrollment's required geographic region under data residency rules.; Whether the model's latency profile supports near real-time response expectations for interactive users.; Whether the model's capability rating is sufficient for the occasional complex multi-step reasoning questions.

• A. Regional availability under data residency rules is a core reference characteristic for regulated data, since a model not offered in the required jurisdiction cannot be used regardless of its other qualities.
• B. Latency directly determines whether the agent can meet near real-time response expectations for interactive users, making it a relevant selection factor for this deployment.
• C. Capability determines whether the model can reliably handle the occasional complex multi-step reasoning questions the agent will encounter, so it is a relevant factor here.
• D. Training data cutoff is not one of the reference characteristics used for model selection in the catalog and has no bearing on capability, latency, cost, or geography for this deployment.
• E. Font rendering is a presentation detail unrelated to model inference and is not a reference characteristic considered when selecting a language model.

Correct answer: A — Capacity is allocated in tiers such as medium, large, and XL, measured in tokens per minute and requests per minute, with medium as the default starting tier.

• A. AIP capacity is organized into medium, large, and XL tiers measured in tokens per minute and requests per minute, with medium provided by default for prototypes and moderate-scale use.
• B. User-attributed workflows are governed by both enrollment limits and per-user limits together, not by an isolated per-user cap with no enrollment-wide ceiling.
• C. Registered models inherit rate limiting the same way Palantir-provided models do, and Palantir-provided models are not exempt from enrollment-level capacity limits.
• D. Capacity limits are set by tier and provider-level constraints, not solely by the enrollment's geographic region, and different providers do not share identical limits.

Correct answer: A — It is subject to the same enrollment-level and user-level rate limits as the Palantir-provided models

• A. A registered model inherits the same enrollment- and user-level rate limits already applied to Palantir-provided models, so it does not get separate or looser governance.
• B. Separate provider billing does not exempt the model from Foundry's own rate limiting; enrollment-level limits still apply regardless of who bills for token usage.
• C. Being externally hosted does not grant an elevated rate limit tier; the registered model is governed by the same limit structure as any other model in the enrollment.
• D. There is no separate token budget carved out exclusively for registered models; usage governance is shared with Palantir-provided models under the same enrollment-level limits.

Correct answer: A — Open the trace view for the request and inspect the span corresponding to the model invocation

• A. Correct — expanding the model-invocation span inside the trace view reveals the prompt, response, and token usage recorded for that specific call within the request.
• B. Incorrect — execution history lists runs and their outcomes over time but does not expose the prompt, response, or token detail for one call inside a request.
• C. Incorrect — log search finds messages and error patterns across many executions of a source executor, which is broader than isolating one span's prompt and token data.
• D. Incorrect — the token usage chart aggregates consumption over time for an application and does not show the prompt or response text for a single call.

Correct answer: A — Restructure the loop to send multiple records per LLM call so fewer, larger requests replace many small ones.

• A. Grouping multiple records into fewer, larger calls reduces the total request count, which directly relieves per-minute rate-limit pressure while keeping the same information available to the model for each classification.
• B. Raising the capacity tier increases the ceiling but leaves the inefficient one-call-per-record pattern in place, so the workflow still issues far more requests than necessary and remains costly.
• C. A more capable model does not reduce the number of requests being sent; the loop still issues one call per record, so the rate-limit bottleneck persists regardless of model choice.
• D. Retrying throttled calls only delays completion further and adds overhead; it does not reduce the number of requests generating the throttling in the first place.

Correct answer: A — User-Scoped execution, which runs with the triggering user's own permissions, isolates logs per user, retains them for twenty-four hours, and is the default mode

• A. User-Scoped execution is the default Logic security mode, runs with the permissions of the individual triggering the function, keeps each user's logs isolated, and purges them after twenty-four hours, matching every part of the requirement.
• B. Project-Scoped execution runs with the project's permissions rather than the individual user's, and it is not the platform default, so it does not deliver the per-user isolation this team needs.
• C. User-Scoped execution runs with the triggering user's own permissions, not the project's permissions, so describing it as running under project permissions misstates how the mode actually works.
• D. Project-Scoped execution makes logs visible to everyone with project access rather than isolating them per user, and it requires deliberate configuration rather than serving as the default.

Correct answer: A — Cipher cryptographically obfuscates sensitive values so they stay hidden, while the Sensitive Data Scanner detects patterns in incoming data.

• A. Cipher's role is cryptographic obfuscation of sensitive values so data can be processed while staying hidden, while the Sensitive Data Scanner's role is proactive detection of sensitive patterns as data enters the platform — two distinct, complementary functions.
• B. This reverses the actual roles: obfuscating values is Cipher's function, while pattern detection on incoming data is what the Sensitive Data Scanner performs, not the other way around.
• C. Neither tool automatically applies access markings; Cipher performs cryptographic obfuscation and the Scanner performs detection, and marking assignment is a separate governance action taken by administrators.
• D. Neither tool is described as removing columns outright or encrypting with a reversible key; Cipher's obfuscation and the Scanner's detection are the actual documented functions of these two tools.

Correct answer: A — Configure the tool to run automatically with lightweight submission criteria, since the change is low-risk and easily reversed.

• A. Letting a low-risk, easily reversible note-append run automatically with light checks avoids adding review overhead that the consequence of the action does not warrant.
• B. Requiring human confirmation and a checkpoint sign-off for every internal note adds heavyweight review to an action whose consequence does not justify that level of friction.
• C. Removing audit logging entirely eliminates the record needed to later verify or adjust how the action behaves, which is unnecessary and unrelated to matching strictness to a low-risk change.
• D. Gating a routine, low-risk note on administrator-level approval applies a strictness level suited to high-consequence actions rather than this reversible change.

Correct answer: A — Delegate sending to a purpose-built tool restricted to pre-approved recipients, with human review for anything else

• A. Delegating the sending action to a purpose-built tool with a restricted recipient list, plus a human checkpoint for anything outside that list, directly closes the path an injected instruction would need to exfiltrate data to an arbitrary address.
• B. Removing conversation history might reduce what data is available to send in one session, but it does not close the underlying vulnerability of an unrestricted email tool that can message any recipient.
• C. Raising the temperature setting increases output randomness and has no relationship to whether a tool is allowed to send data to arbitrary, unapproved recipients.
• D. More few-shot examples about writing professional emails improve tone and formatting, not the tool's authorization boundaries, so this does not prevent a manipulated agent from emailing an unapproved recipient.