Microsoft AB-100 Practice Test 89

Question 880

A knowledge agent retrieves restricted incident notes under a privileged service identity, then ranks them before hiding some in the UI. What must be changed?

Give every caller the service identity’s full permissions.
Filter eligible documents by the caller’s current permissions before any ranking or model-context construction.
Hide private document titles in the final answer only.
Ask the model to ignore notes labeled Confidential.

Explanation

Correct Answer

Unauthorized content should not enter reranking, prompts or logs simply because it matches a query.

Incorrect Answers

Broad blanket grants violate the organization’s least-privilege document-access requirement.

Sensitive passage text can still influence generation or leak through traces.

A label-based instruction is not a server-side user entitlement check.

Question 881

A project lead removes a contractor’s SharePoint access, but the agent still returns previously cached paragraphs. Which control is needed?

Hide document URLs but retain the cached paragraph text.
Ask the model to avoid mentioning the contractor’s former project.
Invalidate or reauthorize cached passages using current document permissions before serving them.
Wait until the contractor closes the Teams window.

Explanation

Correct Answer

Cached retrieval is still a read operation and must honor revocation.

Incorrect Answers

Removing links does not remove protected content from answers.

Text instructions cannot ensure cached confidential material is excluded.

Client session closure cannot substitute for authoritative access revocation.

Question 882

A sales agent can read customer contact names but not credit-limit values. The CRM retrieval endpoint returns both in one JSON object. How should the connector respond?

Return both fields and obscure the credit limit visually.
Base64-encode the credit limit while passing it to the model.
Ask the model to choose which fields seem sensitive.
Return only approved fields for the authenticated user, excluding credit limits before prompt construction.

Explanation

Correct Answer

Row access does not imply entitlement to every sensitive column of the same record.

Incorrect Answers

The model or logs may still process the prohibited financial field.

Encoding does not change the underlying data permission.

Field access classification must be governed, not inferred ad hoc during generation.

Question 883

A tenant A employee asks for a contract clause. The closest embedding result belongs to tenant B, while a slightly lower-ranked tenant A result exists. What should search do?

Restrict candidates to tenant A’s authorized set before computing or applying final relevance ranking.
Choose tenant B’s result because it has the highest similarity score.
Combine both clauses to maximize answer richness.
Hide tenant B’s filename but quote its clause.

Explanation

Correct Answer

Semantic similarity cannot override tenant isolation when choosing source evidence.

Incorrect Answers

Ranking relevance is separate from data access permission.

Mixing tenant B’s confidential terms into A’s response is unauthorized.

Filename removal does not protect the underlying contract content.

Question 884

A parent agent passes an HR question to a child search agent. The child runs with global HR library access. What must be enforced?

Use only the employee’s typed first name as identity evidence.
Carry authenticated caller entitlements and apply them at the child agent’s retrieval service.
Allow the child agent to answer from every file and rely on the parent to redact.
Give all parent agents global HR access for consistent results.

Explanation

Correct Answer

Delegation should preserve, not expand, the user’s effective document scope.

Incorrect Answers

Names are not sufficient authentication or authorization context.

Late filtering cannot prevent sensitive passages from influencing the child’s reasoning.

Uniform privileges bypass individual and department restrictions.

Question 885

A manager becomes an individual contributor. They may still read general policy but not manager-only compensation procedures. What should the retrieval regression assert?

Deny all help documents because some manager access was revoked.
Allow retrieval but instruct the model not to quote sensitive salary terms.
General policy remains available while compensation documents are denied under the new role and caches are revalidated.
Keep all earlier manager documents accessible until the employee logs out.

Explanation

Correct Answer

A role change requires granular updates rather than blanket success or total denial.

Incorrect Answers

Overblocking would also deny ordinary users the legitimate general-policy access they retain.

Text instructions cannot replace enforceable document-level access trimming before retrieval.

Stale entitlement can continue leaking confidential HR procedures.

Question 886

A legal agent captures a document during a privileged meeting. Later the requester’s access expires, but the agent can still use saved snippets. What should it do?

Keep using the snippet because it is already in the agent memory.
Only delete its source citation and leave the facts in responses.
Ask the model to decide whether the requester deserves access.
Reauthorize retained snippets against current entitlements before reuse or discard them when access expires.

Explanation

Correct Answer

Permission at an earlier retrieval time does not grant indefinite rights to derivative context.

Incorrect Answers

Cached content remains protected after access revocation.

Withholding provenance does not stop disclosure of restricted information.

Business authorization must come from the source system and policy, not generated opinion.

Question 887

A procurement agent recommends a supplier change and a manager approves it. An auditor must reconstruct why the change occurred and who authorized it. Which TWO records are necessary? (Select TWO.)

Only the assistant’s final conversational message.
A screenshot of the user interface without transaction identifiers.
An unversioned summary that overwrites earlier audit history.
Immutable business-action record with request, verified approver, time and commit result.
Versioned model, prompt and governing source references used to produce the recommendation.

Explanation

Correct Answers

The audit must prove which authorized person approved the specific transaction and what changed.

Decision provenance identifies which AI configuration and authoritative evidence influenced the proposal.

Incorrect Answers

Generated claims cannot prove a durable committed supplier change or signed approval.

Visual evidence alone does not bind the approval to an exact backend record.

Mutable summaries cannot reliably reconstruct prior decisions after later changes.

Question 888

A knowledge manager replaces a published policy PDF with a new file of the same name. An agent’s answers change, but records show only the filename. What should be logged?

Ask the agent to describe the older policy from memory.
Immutable source document ID, revision hash, effective date, approver and ingestion time for the change.
Only the newest display filename.
The number of words in the replacement document.

Explanation

Correct Answer

File naming does not distinguish revisions; an auditable source history must reproduce what was actually published.

Incorrect Answers

Generated recollection is not a reliable historical source record.

An unchanged filename cannot identify which policy bytes were previously used.

Word count provides no authoritative revision or approval evidence.

Question 889

A finance tool rejects a model-generated request to pay an unapproved supplier. The operations team wants to delete the record because nothing was paid. What is the correct audit policy?

Reclassify the denied attempt as an approved payment.
Publish raw payment credentials alongside the denial for transparency.
Retain a protected denial event with requester, attempted operation, reason and trace correlation under the retention policy.
Delete all denied calls to improve apparent transaction success.

Explanation

Correct Answer

Denied actions are meaningful evidence for detecting misuse, faulty prompts and attempted privilege escalation.

Incorrect Answers

An authorization refusal is the opposite of a committed financial transaction.

Credentials are unnecessary to explain the event and introduce additional exposure.

Concealing failures prevents review of policy and security incidents.

Question 890

An insurance assistant uses one model on Monday and another on Tuesday under an unchanged display alias. An auditor needs to replay Tuesday’s recommendation. What should be captured?

Only the displayed model alias.
The representative’s personal view of which model felt faster.
Only the final recommended outcome.
The resolved model artifact/deployment ID with prompt version, source snapshot and evaluation settings for that run.

Explanation

Correct Answer

Mutable aliases conceal backing-model changes unless actual serving artifacts are recorded.

Incorrect Answers

An alias can point at multiple artifacts over time.

Subjective impressions do not prove exact model identity.

An outcome without input/configuration provenance cannot be independently reconstructed.

Agentic AI Business Solutions Architect (AB-100) Practice Tests

Microsoft AB-100 Practice Test 87 - 10 Questions (Last Reviewed 15-Oct-2026)
Microsoft AB-100 Practice Test 88 - 10 Questions (Last Reviewed 14-Oct-2026)
Microsoft AB-100 Practice Test 89 - 10 Questions (Last Reviewed 13-Oct-2026)
Microsoft AB-100 Practice Test 90 - 10 Questions (Last Reviewed 12-Oct-2026)

Pass Your Microsoft AB-100 Exam Easy!

Question 880

Explanation

Correct Answer

Incorrect Answers

Question 881

Explanation

Correct Answer

Incorrect Answers

Question 882

Explanation

Correct Answer

Incorrect Answers

Question 883

Explanation

Correct Answer

Incorrect Answers

Question 884

Explanation

Correct Answer

Incorrect Answers

Question 885

Explanation

Correct Answer

Incorrect Answers

Question 886

Explanation

Correct Answer

Incorrect Answers

Question 887

Explanation

Correct Answers

Incorrect Answers

Question 888

Explanation

Correct Answer

Incorrect Answers

Question 889

Explanation

Correct Answer

Incorrect Answers

Question 890

Explanation

Correct Answer

Incorrect Answers

Agentic AI Business Solutions Architect (AB-100) Practice Tests