Microsoft AB-100 Practice Test 40

Question 390

A marketplace operates under a contract that restricts buyer payment history to a named region. During a regional incident, its agent automatically fails over to a global model deployment. What should happen?

Send only generated summaries while including full payment history in the prompts.
Assume the model provider will infer the data’s residency from the merchant name.
Allow global failover because availability always overrides data-location obligations.
Block noncompliant failover and use an approved in-region recovery path or a clearly limited service mode that never exports restricted histories.

Explanation

Correct Answer

Failover designs must enforce processing geography even during outages and define safe degraded behavior when compliant capacity is unavailable.

Incorrect Answers

A summarized output does not change where the input history is processed.

Inferred geographic labels are not policy-backed location controls.

High uptime does not eliminate contractual restrictions on sensitive records.

Question 391

A bank’s risk agent indexes loan files under a broadly privileged service principal. A compliance officer is later removed from a loan team but can still retrieve old indexed documents in chat. What authorization repair is needed?

Change the index metadata so documents display the current team roster, but continue serving results from cached broader credentials.
Enforce up-to-date source ACLs at query-time and invalidate cached access after team membership changes.
Leave previously indexed content available because the user once had access.
Keep retrieval broad and ask the model to omit the former team name from its answer.

Explanation

Correct Answer

Grounding entitlements must respond to revocation and be applied before restricted passages reach the model.

Incorrect Answers

Displaying updated roster metadata cannot revoke the previous service-principal retrieval path. Query-time ACL enforcement and cache invalidation are essential.

Historical membership does not authorize later disclosure.

Model formatting is not a query-time security boundary.

Question 392

A retail pricing agent modifies customer loyalty discount rules. Two employees dispute which change was used for a particular purchase. What audit design is necessary?

Version the effective discount policy and log actor, approval, change time, agent release and the purchase correlation ID in append-only records.
Allow the discount runtime to overwrite old change records after reconciliation.
Record that the agent had a successful conversation at some point that day.
Store only the current discount rate in the customer portal.

Explanation

Correct Answer

A decision-specific, tamper-resistant timeline ties the applied rule to an accountable authorized change.

Incorrect Answers

Editable history undermines dispute resolution and audit integrity.

Conversation success cannot prove which discount rule was in effect.

Current configuration cannot reconstruct the rate applied at the time of purchase.

Question 393

A construction-payment agent receives a signed approval token for a 40,000-unit change order, but the approved maximum was 25,000. What must its payment API do?

Pay 25,000 without customer or approver review and silently leave the balance open.
Reject the out-of-limit amount and require a new approval tied to the exact change-order version and value before posting.
Proceed because the approval token is cryptographically valid, regardless of amount mismatch.
Ask the model to rewrite its explanation so the approval appears to cover 40,000.

Explanation

Correct Answer

A valid signer and token are necessary but not sufficient; the approved amount and operation must match the actual transaction.

Incorrect Answers

Partial silent payment can breach the business contract and obscure outstanding obligations.

Signatures do not grant amounts outside the signed business scope.

Editing generated prose does not change an authoritative approval payload.

Question 394

A utility assistant uses a knowledge-reading identity to inspect outage reports. Its tool-call planner attempts to modify a service principal’s role assignments to access additional sites. Which architecture prevents this?

Let the agent modify roles when it says more sites would improve answer accuracy.
Remove the role-editing command from the agent instructions while leaving the same elevated backend tool credential available.
Give the agent a standing tenant administrator identity to reduce authorization failures.
Remove role-management capability from the agent’s tool set and enforce immutable least-privilege permissions at the identity provider.

Explanation

Correct Answer

A read-only assistant must not have privileges to escalate its own authorization; backend identity boundaries are fundamental.

Incorrect Answers

Answer quality is not a valid reason to expand identity privileges autonomously.

Prompt hiding does not revoke executable permissions: a compromised or mistaken tool call could still change identity roles with that credential.

Standing administrative authority would create an excessive blast radius.

Question 395

A marketplace’s agent registry shows two production refund bots with the same displayed name but different action permissions. What information must distinguish them?

The count of successful chats as the sole distinguishing attribute.
Their friendly names alone, because users cannot see implementation details.
Stable unique agent IDs, owner, version, environment, data scope and approved tool permissions in a governed registry.
Use a friendly name plus creation timestamp to distinguish the bots, without recording which deployed agent ID carries each refund permission.

Explanation

Correct Answer

Operational identity and approved capabilities must be unambiguous for access review, incidents and rollback.

Incorrect Answers

Usage counts do not show which tool permissions or artifact versions are active.

Names can collide while execution permissions differ significantly.

Names and timestamps can be duplicated or changed and do not bind the active tool policy to an immutable agent identity.

Question 396

A finance agent publishes forecasts through a custom model endpoint. An engineer wants to speed diagnosis by writing model access tokens into ordinary application traces. What should the security architect require?

Log the tokens in full because the application traces are inside the corporate network.
Give all finance analysts the same long-lived token so traces can be reproduced.
Keep tokens in secure identity or secret-management facilities, log only redacted identifiers and enforce short-lived scoped access.
Store tokens as model-training metadata instead of application log fields.

Explanation

Correct Answer

Operational diagnostics need request identifiers rather than reusable bearer credentials; limit token exposure and lifetime.

Incorrect Answers

Internal logs can be exported and accessed by more staff than the secret store.

Shared standing tokens prevent meaningful caller attribution and expand leak impact.

Training artifacts are an even less appropriate location for live secrets.

Question 397

A retail search agent reads a supplier’s catalog page. The page contains a benign-looking table but a cell instructs the agent to update store inventory prices. Which threat response is correct?

Accept the instruction because it was located in a structured table, not a chat message.
Authorize it when the supplier URL uses HTTPS, which proves the content is safe.
Treat table cells as untrusted product data and require an authenticated price-change workflow with a separate permission check.
Change output formatting so the table instruction is harder for end users to notice.

Explanation

Correct Answer

The transport and formatting of retrieved content do not grant it authority to invoke tools with financial effects.

Incorrect Answers

A structured table can carry the same indirect injection payload as ordinary text.

HTTPS protects the connection but cannot guarantee trusted content instructions.

Concealing output leaves the unauthorized tool path exposed.

Question 398

A construction safety-inspection agent flags site photographs as compliant. Its false-negative rate is low overall but substantially higher for workers wearing dark protective clothing under poor lighting. What review should be conducted?

Measure the error rate on the affected visual subgroup and conditions, improve representative data or capture protocols, and require safety escalation.
Rely on the average score across all well-lit and low-light photos combined.
Treat a confident generated safety description as enough evidence of compliance.
Exclude low-light images from monitoring while continuing to accept them in production.

Explanation

Correct Answer

Safety outcomes require reliable performance across foreseeable visual conditions, particularly when a miss could expose a worker to harm.

Incorrect Answers

Aggregate metrics can conceal a severe low-light subgroup failure.

Model confidence or fluent text cannot establish a correct safety inspection result.

Suppressing problematic observations hides the risk rather than mitigating it.

Question 399

An energy operator has residency requirements for outage incident notes. Its primary model and storage are local, but an optional model-safety review tool sends full incident prompts to an unapproved region. What should the design do?

Disable or replace the noncompliant review path with an approved regional service, and verify all monitoring and safety-processing destinations.
Allow the data transfer because safety review tools are exempt from residency by default.
Assume geographic restrictions apply only to archived incidents, not live prompts.
Strip direct identifiers from the final answer but continue passing unredacted outage prompts to the external safety endpoint.

Explanation

Correct Answer

The entire inference and safety pipeline must respect data-movement constraints; optional components are still processors.

Incorrect Answers

A safety purpose does not automatically override an organization’s explicit residency obligation.

Live incident notes can be just as regulated as historical stored records.

Answer redaction occurs after the prohibited transfer; residency requirements must govern every outbound model, tool and safety-processing call.

Question 400

A marketplace indexes seller invoices in a shared search service. Each invoice source record also embeds a customer shipping address and internal wholesale margin that guest sellers must not see. A seller is authorized for their own invoice totals only. What permission-trimming architecture prevents the model from receiving the restricted fields?

Retrieve entire authorized invoice documents and ask the model to omit shipping addresses and wholesale margins in its final answer.
Rank visible invoice totals above restricted fields so sensitive snippets are less likely to appear in search results.
Allow full document retrieval and mask sensitive fields in the rendered user interface after the model has used the content.
Separate protected fields or passages into permission-scoped records and enforce both seller ownership and field/passage entitlements before grounding.

Explanation

Correct Answer

Enforce permission-aware field projection or chunk-level filtering at the source/retrieval boundary, and verify tenant ownership so only entitled invoice facts enter the model context.

Incorrect Answers

Document ownership alone does not authorize every field. Once a full invoice chunk enters context, output instructions cannot guarantee sensitive margin and address data remain unseen.

Ranking is not authorization: lower-ranked but retrieved chunks can still disclose protected values to the model or its traces.

Client-side masking does not revoke model-context access to restricted invoice fields, even when they do not appear visibly in the answer.

Agentic AI Business Solutions Architect (AB-100) Practice Tests

Microsoft AB-100 Practice Test 38 - 10 Questions (Last Reviewed 07-Oct-2026)
Microsoft AB-100 Practice Test 39 - 10 Questions (Last Reviewed 06-Oct-2026)
Microsoft AB-100 Practice Test 40 - 10 Questions (Last Reviewed 05-Oct-2026)
Microsoft AB-100 Practice Test 41 - 10 Questions (Last Reviewed 04-Oct-2026)
Microsoft AB-100 Practice Test 42 - 10 Questions (Last Reviewed 03-Oct-2026)

Pass Your Microsoft AB-100 Exam Easy!

Question 390

Explanation

Correct Answer

Incorrect Answers

Question 391

Explanation

Correct Answer

Incorrect Answers

Question 392

Explanation

Correct Answer

Incorrect Answers

Question 393

Explanation

Correct Answer

Incorrect Answers

Question 394

Explanation

Correct Answer

Incorrect Answers

Question 395

Explanation

Correct Answer

Incorrect Answers

Question 396

Explanation

Correct Answer

Incorrect Answers

Question 397

Explanation

Correct Answer

Incorrect Answers

Question 398

Explanation

Correct Answer

Incorrect Answers

Question 399

Explanation

Correct Answer

Incorrect Answers

Question 400

Explanation

Correct Answer

Incorrect Answers

Agentic AI Business Solutions Architect (AB-100) Practice Tests