Pass Your Microsoft AI-901 Exam Easy!

A model can generate plausible policy changes but cannot know which rule was enacted. Statistical extrapolation from earlier editions is not proof of today’s eligibility requirements.

An old document can carry a legitimate revision identifier yet be superseded. The assistant must verify current authority or explicitly withhold a binding eligibility answer.

Concealing the old date makes an obsolete rule appear presently binding. If mentioning historical policy is useful, label it explicitly as historical and avoid treating it as the live determination.

Unreviewed new categories break the agreed Billing, Delivery and Account routing contract. Low confidence should trigger defined fallback or human review, not spontaneous downstream queue creation.

Examples displayed inside the prompt are development inputs, not unseen evaluation evidence. Testing only those examples can overstate performance and miss fresh customer wording or category ambiguity.

Replacing real test emails with generated descriptions changes the input and can hide important signals or edge cases. Performance needs to be measured on representative original messages.

Authentication to a chat service does not grant access to protected payroll records or authority to rewrite higher-priority instructions. The data service must independently enforce employee entitlements.

Instruction order is not simply recency; ordinary user input does not supersede higher-priority application restrictions. Otherwise a prompt injection could nullify confidentiality on demand.

Retrieving all payroll records already exposes protected information to the model context and possible tracing systems. Output filtering happens too late to enforce authorized data access.

Formatting constraints alone can produce neatly structured but unsupported actions. The prompt also needs the trusted ticket input, intended audience and pending-state rules.

A sample demonstrates format but must not supply facts for new cases. Carrying its content forward would misattribute another customer’s issue and obscure the incoming ticket’s actual outstanding actions.

Truncating text at punctuation cannot reliably produce three action bullets and can remove required citations or pending-state qualifiers. Format enforcement should validate the completed structured result.

A plausible identifier does not prove the cited passage was retrieved or supports the claim. The cited ID must resolve to an authorized source and relevant evidence.

Confidence expresses model assessment, not a source identifier. Replacing a false citation with a percentage would not allow an auditor to verify the regulatory claim.

Invented URLs can make unsupported advice appear documented and may lead users to nonexistent or unrelated content. Citations must originate from actual authorized retrieval results.

A policy rate can change after the prompt was authored, so embedded historical text is not proof of the current interest charge. Stale values may produce incorrect loan guidance.

A recently edited prompt may still contain a rate that was superseded earlier or scheduled for a later effective date. Revision timestamp alone is not the business rule’s validity period.

Changing temperature affects token sampling, not access to live rate tables. A more creative guess can make a financial answer less dependable.

A retrieved FAQ is untrusted content for the assistant’s task, not a way to fix conflicting top-level safety instructions. Elevating it would make the contradiction harder to control.

Repeating two incompatible directives does not define which response is correct when sources are missing. It may produce unstable behavior across phrasing variations.

A larger context window increases input capacity but cannot reconcile a logical conflict between “never mention uncertainty” and “escalate when evidence is missing.”

A high relevance score does not authenticate a page as an application instruction. Escalating its role allows an attacker-controlled article to direct privileged tools.

A string filter can miss differently phrased or obfuscated prompt injection and still leaves untrusted article destinations able to trigger actions.

Approved indexing does not mean every article-supplied URL is safe or authorized for a particular customer. The network and data-access boundary must be enforced separately.

Pretrained model knowledge may be stale, incomplete or unrelated to the organization’s controlling rules. It cannot fill a missing compliance source while claiming definitive authority.

An archived hit might be semantically related but superseded. It cannot establish current compliance authority and should not be given as a definitive rule when evidence is missing.

Similar archived documents can contain superseded provisions and wrong effective dates. Forcing a citation to them creates false assurance that the current answer is supported.

A model-generated assurance cannot prove that the entire payload is one JSON object with the required keys and types. The consumer must parse and validate the actual bytes rather than rely on a confidence statement.

Removing trailing prose may recover a parseable fragment in some cases, but the required contract can still be violated. The client must validate the complete structured response instead of silently accepting partial fixes.

A permissive consumer is not a reliable structured-output contract and can behave differently after an SDK upgrade. Rejecting nonconforming responses protects downstream parsing and action validation.

Retrieval verifies a page was found, not that its embedded commands should govern the application. Promoting web instructions into a system role opens the toolchain to hostile content.

HTTPS protects transport to a domain but does not establish that the site may authorize internal customer-record exports. The page’s security origin and the caller’s data rights are separate concerns.

Cleaning displayed text does not undo a customer-record export already triggered by an untrusted document. Tool authorization must prevent data transfer to unauthorized recipients regardless of what later appears in the chat answer.