The correct choice is to use a model cascade that routes the requests to different models . In Microsoft Foundry, this pattern aligns with model routing: simple, low-risk prompts can be handled by smaller, faster, lower-cost models, while complex prompts can be escalated to more capable or reasoning models. Microsoft’s Foundry model router guidance states that the router optimizes cost and latency while maintaining comparable quality by using smaller, cheaper models when they are sufficient and larger or reasoning models when the task requires more advanced capability.

This directly matches the scenario: most traffic consists of simple FAQs, so routing those requests to efficient models reduces average latency and token-processing cost. Advanced reasoning requests still receive high-quality responses because they are routed to models with stronger reasoning capability. Microsoft’s model router documentation also explains that routing decisions consider prompt difficulty, cost, quality, latency, and conversation context, making it suitable for diverse chat workloads.

Increasing max_tokens for all requests would usually increase cost and latency. Sending all requests to a smaller model risks poor quality for complex questions, while sending all requests to the most capable model wastes cost and latency on simple FAQs. Reference topics: Microsoft Foundry model routing, model selection, generative AI optimization, latency management, and cost-aware AI application design.

The solution does not meet the goal. A completeness evaluation flow is useful for detecting incomplete responses, but detection and blocking do not improve the response itself. Microsoft Foundry RAG evaluators define Response Completeness as a metric that measures whether a response covers all critical information from the expected response or ground truth. It is a system evaluation signal used to assess response quality and produce pass/fail or scored results.

In this scenario, the issue is that the agent omits required regulatory clauses even though the clauses are present in retrieved content. Blocking low-scoring responses would prevent incomplete answers from being returned, but it would not revise the summary, add the missing clauses, or improve the generation process. The appropriate improvement is to add a response-generation control such as a reflection or verification pass that checks the draft summary against the retrieved policy content and regenerates or amends the answer before returning it. Evaluation can support the quality gate, but by itself it is an assessment mechanism, not a completeness-enhancement mechanism. Reference topics: Microsoft Foundry RAG evaluators, response completeness, grounded generation, reflection, and response quality optimization.

The correct answer is A. Speech recognition requests will fall back to the most recent base model for the same locale . Microsoft’s custom speech model lifecycle guidance states that when a model expires, it is no longer available for transcription. For the custom endpoint route, speech recognition requests fall back to the most recent base model for the same locale. The documentation also warns that recognition results might still be returned, but the transcription may no longer reflect the domain-specific adaptation of the custom model.

This distinguishes real-time custom endpoint behavior from batch transcription behavior. Batch transcription requests that specify an expired model fail with a 4xx error, but that is not the route described in this question. The agent is using a custom endpoint for real-time recognition, so fallback to the latest base model is the expected behavior. The model is not automatically deleted merely because it expires, and it does not continue to use the expired custom model indefinitely. The operational recommendation is to update the endpoint’s model before expiration by redeploying the endpoint with a newer custom model. Reference topics: Azure Speech custom speech model lifecycle, custom endpoints, model expiration, real-time speech recognition, and endpoint redeployment.

type: ask_question

condition: approval == " approved "

The approval step must use type: ask_question because the workflow must pause and wait for a human response before the refund execution proceeds. Microsoft Foundry workflows support human-in-the-loop patterns where the workflow asks the user a question and awaits input before continuing; this pattern is explicitly intended for approval requests and clarifying questions. The workflow guidance also identifies workflows as declarative sequences that orchestrate agents and business logic, including branching logic and human-in-the-loop steps.

The refund execution step must use condition: approval == " approved " so that the second invocation of PaymentAgent runs only when the approval response matches the required approval value. Using true would always execute the refund, bypassing the approval control. Using propose_refund.output != null would only confirm that the first agent step produced output; it would not prove that a human approved the refund. data_transformation is also incorrect for the approval node because it sets or parses values rather than pausing for user input. Reference topics: Microsoft Foundry workflows, human-in-the-loop workflow pattern, YAML workflow editing, agent orchestration, conditional execution, and workflow approval gates.

The correct answer is C because the requirement is a localized image edit: remove only the competitor logo while preserving the rest of the already generated image. Azure OpenAI image editing is designed for modifying existing images based on a text instruction, rather than regenerating the entire image from scratch. Microsoft’s Azure OpenAI image guidance states that the Image Edit API modifies existing images and requires an input image as part of the request. In a mask-based inpainting workflow, the mask identifies the exact region to change, allowing the model to replace only the logo area while retaining surrounding background, composition, lighting, and product content.

Increasing prompt guidance strength would affect adherence during generation, but it would not safely remove a specific logo from a completed image. Modifying the original prompt and regenerating may create a different image and does not guarantee preservation of the approved visual content. Rerunning with a different random seed also changes the image unpredictably and may introduce new brand or legal issues. Mask-based inpainting is the minimal-change remediation method for post-generation brand cleanup. Reference topics: Azure OpenAI image editing, inpainting, mask-guided edits, image generation governance, and computer vision solutions.

The correct answer is D. prompt shields for documents . The OCR text is extracted from uploaded images and appended as additional context, so it is third-party content rather than a direct trusted user instruction. Microsoft Foundry Prompt Shields distinguish between user prompt attacks , which are malicious instructions directly supplied as user prompts, and document attacks , which are hidden or embedded instructions in third-party content such as documents, emails, webpages, or grounded data. Microsoft also notes that Prompt Shields analyze indirect attacks embedded in input documents or images.

This scenario is an indirect prompt injection pattern: an uploaded screenshot may contain text that says to ignore the system prompt or perform unauthorized actions. Because the OCR output is being passed to the multimodal model as contextual content, the appropriate protection is Prompt Shields for documents, which scans externally sourced context for malicious embedded instructions before generation. Protected material text detects known copyrighted text in model outputs, not prompt injection. Image moderation detects harmful visual content categories, not malicious instructions in extracted context. Prompt Shields for user prompts are less precise here because the risk comes from document-like content derived from the uploaded image. Reference topics: Prompt Shields, document attacks, indirect prompt injection, multimodal safety, OCR-derived context, and Foundry guardrails.

Access up-to-date information from public websites: Grounding with Bing Search

Perform calculations during conversations: Code interpreter

Retrieve information from documents uploaded directly to the agent: File search

The correct tool for public, current web information is Grounding with Bing Search . Microsoft Foundry Agent Service identifies Grounding with Bing Search as the built-in tool that enables an agent to access and return information from the internet, which fits the requirement for up-to-date public website data. ( learn.microsoft.com )

For calculations during conversations, use Code interpreter . Microsoft’s Foundry guidance states that Code Interpreter enables an agent to run Python code in a sandboxed execution environment and solve data analysis and math tasks iteratively. This is the correct fit for financial analysts who need calculations, analysis, and potentially chart generation during the conversation.

For documents uploaded directly to the agent, use File search . Microsoft describes File Search as the tool that enables Foundry agents to search through documents, retrieve relevant information, and augment model responses with knowledge from uploaded files such as PDFs, Word documents, and proprietary content.

Computer use is for interacting with graphical applications, not calculation or document retrieval. Microsoft Fabric is for enterprise data and analytics integration, not direct uploaded document retrieval. Reference topics: Foundry Agent Service tools, Code Interpreter, File Search, and Grounding with Bing Search.

Authentication method: An Azure Login action that uses OpenID Connect (OIDC)

If the evaluation results are NOT met, configure the workflow to: Fail

The correct authentication method is Azure Login with OpenID Connect (OIDC) . Microsoft Foundry’s GitHub Actions evaluation guidance recommends Microsoft Entra ID authentication and states that authentication can be automated by using the Azure Login GitHub action with OpenID Connect. The sample evaluation workflow also grants id-token: write, runs azure/login@v2, and then invokes the Microsoft AI Agent Evaluation action. This is the appropriate CI/CD authentication pattern because it avoids long-lived personal access tokens and supports secure federated authentication from GitHub Actions into Azure.

The workflow should be configured to fail when evaluation thresholds are not met. Foundry’s evaluation GitHub Action is designed to automate pre-production assessment of Microsoft Foundry agents in CI/CD pipelines and produce evaluation results for the configured evaluators and test dataset. A failed GitHub Actions check can then be enforced through branch protection so the PR cannot merge until the quality gate passes. Locking the target branch or sending an alert does not directly implement a CI quality gate. Reference topics: Microsoft Foundry agent evaluation, GitHub Actions evaluation workflow, Microsoft Entra authentication, Azure Login with OIDC, pull-request quality gates, and CI/CD governance.

temperature = 0

output_config = { " effort " : " high " }

The correct configuration is temperature = 0 and output_config = { " effort " : " high " }. The requirement is to reduce small wording variations that are breaking automated validation. In chat completion requests, temperature controls sampling randomness. Microsoft’s Azure OpenAI reference states that temperature ranges between 0 and 2, and that higher values make output more random while lower values make output more focused and deterministic. Therefore, the most stable setting from the available choices is 0, because it minimizes randomness and improves repeatability for validation-sensitive response patterns.

The solution must also maximize reasoning quality. The code already enables thinking with thinking={ " type " : " enabled " }, so the remaining reasoning-quality control is the effort setting. Microsoft Foundry model guidance states that the effort parameter controls the quality/cost tradeoff and supports low, medium, and high effort levels. Selecting " high " maximizes reasoning quality among the available options.

Using temperature values of 1 or 2 would increase variability and make validation mismatches more likely. Selecting low or medium effort would not meet the requirement to maximize reasoning quality. Reference topics: Microsoft Foundry model inference, chat model parameters, temperature, thinking, effort, and output stability.

Set tool_choice to: required

Configure the tool to authenticate by: Using a distinct agent identity bound to the client application

Set tool_choice to required because the compliance workflow must deterministically include a tool-based retrieval step before the agent generates a response. Microsoft Foundry Agent Service guidance states that tool_choice provides the most deterministic control over tool use: auto lets the model decide, none prevents tool calls, and required forces the model to call one or more tools. This directly corrects the current nondeterministic behavior where the model decides whether to call tools.

For authentication, use a distinct agent identity bound to the client application . Microsoft Foundry creates a shared identity for unpublished or in-development agents, but publishing an agent automatically creates a dedicated agent identity blueprint and agent identity associated with the agent application resource. Published agents authenticate tool calls by using that unique agent identity, and RBAC permissions must be assigned to the new identity. This provides isolation from the broader shared project identity and supports independent audit trails for compliance workflows.

Storing API keys in prompts violates security guidance and prevents robust audit attribution. The shared project agent identity is easier for development, but it has a broader blast radius and does not meet the isolation requirement. Reference topics: Foundry Agent Service tool choice, tool authentication, published agent identities, RBAC, and auditability.