Pass Your Microsoft AI-901 Exam Easy!

Retrieval verifies a page was found, not that its embedded commands should govern the application. Promoting web instructions into a system role opens the toolchain to hostile content.

HTTPS protects transport to a domain but does not establish that the site may authorize internal customer-record exports. The page’s security origin and the caller’s data rights are separate concerns.

Cleaning displayed text does not undo a customer-record export already triggered by an untrusted document. Tool authorization must prevent data transfer to unauthorized recipients regardless of what later appears in the chat answer.

Disclosing all private account history exceeds the stated explanation need and may reveal unrelated personal details. A user asking “why” does not automatically authorize broader access to protected data.

An unexplained score prevents people from identifying consequential errors or requesting appropriate review. Privacy does not require withholding all non-sensitive decision reasons.

Public shared logs of inputs and intermediate model text greatly expand exposure and retention of financial records. Traces should use appropriate redaction, access control and purpose-limited storage.

Concatenating raw field values into a privileged system message makes attacker-controlled notes look like instructions. A template must not grant privilege merely because a user supplied a string.

Placeholders control text interpolation, not type safety or trust precedence. Validate customer ID ownership, topic enumeration and note length before interpolation.

Choosing the last free-text customer ID can override the actual authorized target and leak another customer’s records. Record identifiers must come from validated, authenticated fields.

Generating several dates does not establish which invoice date, if any, is printed in the document. Selection must depend on source evidence rather than the diversity of guesses.

Examples can improve output formatting but do not authorize replacing absent invoice fields with today. The operational failure is unsupported date invention, not just date formatting.

A syntactically valid date can still be fictitious. Schema validation must be paired with a source-backed field presence check before an invoice is posted.

Maximizing engagement can encourage unsafe interactions or dependency without measuring task correctness or child safety. The release gate must include age-appropriate harm controls.

An unrestricted financial-action tool can cause real-world harm irrespective of how reassuring the assistant sounds. Tool permissions and transaction approval must be restricted independently.

Assuming adulthood from silence is not a reliable access-control policy. For uncertain age or eligibility, use conservative protections consistent with the service’s documented requirements.

An additional vague request inside the same user string does not establish instruction priority, typed outputs or permission checks. It leaves the central trust-boundary problem unresolved.

Elevating every user message would give untrusted callers power to redefine the application’s governing rules and tool behavior. The authenticated application must retain control of privileged instructions.

A larger context may accommodate more instructions but does not confer role priority or validate machine-readable fields. Application-level parsing and explicit instruction separation remain necessary.

The most recently indexed search hit can still be a draft, a future change or a superseded rate. Search position is not authorization to make a binding quote.

Extrapolating from earlier prices cannot determine today’s approved customer-specific amount, promotions or taxes. A price quote needs actual effective source data.

Confidently inventing a price increases risk of customer disputes and financial loss. Unavailable authoritative pricing should produce a limitation or controlled handoff, not a fabricated answer.

Token limits apply only after a supported target is resolved. Raising a generation budget cannot provision or select the named model deployment that the caller has not created.

Typing a catalog name into a user prompt is content, not a provisioning operation. Model deployment requires explicit management actions and the proper authorization.

A text-analysis service may expose different tasks and payloads and cannot be treated as the desired chat deployment by changing endpoint addresses arbitrarily.

An image filename contains no pixel evidence and a text-only model cannot inspect the requested photograph through a supported image-content input. It will be unable to perform reliable visual helpdesk analysis.

Parameter size does not establish visual modality support, compliance fit, latency or affordability. A smaller supported vision model may serve this task better.

Foundry availability and quotas can vary by model version, geography, subscription and deployment type. Production selection needs a configuration-specific availability check.

Token budgeting affects generation, not project-scoped deployment lookup. The intended deployment remains unavailable at the wrong endpoint regardless of output size.

The model family name does not create a missing deployment in the second project. Changing to a catalog label would reintroduce an alias mismatch without repairing endpoint scope.

Testing with exposed credentials creates a separate security failure and does not prove which project is intended. The correct fix is an authorized client configured to the hosting resource.

A created-deployment notification proves a management operation completed, not that customer prompts, grounding, safety behavior or response shape meet release requirements.

Publishing a chatbot after provisioning alone exposes users to untested hallucinations, prompt-injection attempts and tool errors. Functional and safety tests are still required.

Model-catalog examples or results from a different model do not exercise the chosen deployed model's actual instructions, safety behavior or endpoint configuration. The target deployment must be tested directly.