Pass Your Microsoft AI-901 Exam Easy!

A system instruction is useful guidance, but an injection can still produce executable shell metacharacters when arbitrary strings run with the tool privilege. A typed, allowlisted operation enforced outside the model is needed to constrain execution.

Keyword blacklists are fragile because dangerous operations can be expressed using quoting, substitutions and alternate syntax. Restricting the available command operations and validating typed parameters is a stronger execution boundary.

Syntactically well-formed shell commands can still delete files or access unauthorized paths. Valid syntax says nothing about the caller’s intent, allowed scope or business authorization.

A search service that is online can still retrieve irrelevant or superseded policy paragraphs. Retrieval uptime says nothing about whether the final generated answer faithfully reflects the controlling return procedure.

Low response latency and a successful HTTP status indicate transport and compute health, not that the refunded amount or time window matches the approved return rule. Operational quality must test the business claim.

Counting answered conversations rewards a bot for replying even when it invents return restrictions. Task success requires verified policy correctness or an honest escalation when the source cannot support a decision.

Removing a name from the final message is too late: confidential compensation has already been retrieved and potentially entered context, traces or intermediate output. Access enforcement belongs before retrieval, not only presentation.

System wording can guide the assistant but cannot reliably enforce record-level payroll authorization under a privileged backend identity. A malicious request or model error can bypass natural-language caution.

Knowledge of an executive’s legal name is not a role assignment or permission check. The confidentiality boundary depends on the signed-in employee’s effective rights to the specific record.

Hiding the contract title merely changes display text. The confidential terms from tenant B may still influence the generated answer or be copied into trace data after the unauthorized retrieval.

Higher similarity thresholds change which documents rank well but do not recognize tenant ownership. A very relevant tenant-B contract remains forbidden to tenant-A regardless of semantic distance.

Title filtering is not a security boundary because indexed chunks can carry private tenant-B clauses under a generic or duplicate title. Enforce tenant or document ACLs at retrieval on each result before the content reaches the model.

Reversible encoding only changes representation of the same secret. Anyone who reads the prompt can decode it, and an LLM may reproduce encoded data even if told not to reveal plaintext.

Keeping the actual credential in versioned repository history preserves the original exposure risk, even if the file is less visible to users. Revoke and rotate the leaked key, then use managed identity or dedicated secret storage outside shared model prompts and source history.

Instructions asking a model to protect its prompt cannot guarantee secrecy when the credential is included as input. The correct boundary removes the key entirely from model context and uses authorized server-side authentication.

Inexpensive storage is a financial observation, not a lawful or business justification for indefinite retention of sensitive medical conversations. The raw transcripts can contain more personal information than the classification task needs.

Deleting useful routed case labels while retaining patient identities and complete transcripts preserves the most sensitive source material. That reverses the data-minimization purpose of this workflow.

Encryption protects some storage threats but does not establish an indefinite business purpose, retention period, or least-privilege access. Unnecessary full transcripts still increase privacy exposure compared with limited, purpose-specific retained records.

An attorney-privileged search account can access private memos that an anonymous visitor is not entitled to see. Reusing it for public traffic makes confidential text retrievable and defeats the service’s legal-document separation.

Stripping the memo filename does not remove the privileged advice itself. The model might paraphrase its conclusions or intermediate traces may preserve the restricted clauses after retrieval.

A model’s guess about which materials are confidential can be wrong, particularly when similar subjects appear in public and internal documents. Document-level policy needs deterministic enforcement by the retrieval layer.

Downsampling an image can reduce pixel detail but does not change why the photo was collected or grant permission to reuse it for model training. Personal and context-sensitive material can remain identifiable even at lower resolution.

A prompt instruction on a deployed model cannot retroactively authorize ingesting a customer photograph during training. Training-data governance is decided before model fitting, not by a later output restriction.

Uploading a photo for a specific support case does not imply unlimited transfer of rights. The new training use must be justified independently of possession of the file.

The database administrator may retrieve confidential salary columns that the signed-in sales analyst cannot access. Hiding those columns from a rendered chart happens only after unauthorized data has already been processed.

Disabling audit logs removes evidence of attempted cross-boundary queries and makes investigation harder. It cannot fix a privilege escalation or prevent restricted records from being returned.

A model may state that payroll data is necessary but it cannot grant payroll entitlements to a sales analyst. Actual identity and database policy, not natural-language rationale, determine query authorization.

Encryption reduces exposure during storage, but indefinite source-audio retention remains unnecessary for the task. Privacy also requires an approved purpose, expiration and deletion rules.

Removing the minimal routing result but keeping the complete conversation discards the least sensitive useful record and retains the high-risk one. That does not align storage with the stated business purpose.

An assumed future training benefit does not authorize repurposing customer calls or indefinite storage. The pipeline must establish a valid use basis and minimize retained recordings.

Reducing retention can reduce the exposure window, but the sensitive account digits still appear in operational logs available to staff and systems during that day. Mask the account fields before logging while retaining non-sensitive diagnostics.

Encryption at rest protects one storage property but does not ensure everyone with log access has a need to see account details. Broad permissions, long retention and trace export can still expose the identifiers.

Capturing every prompt and response for all staff increases the number of stores containing sensitive bank values. Unless explicitly authorized and minimized, full-content logging is unnecessary to troubleshoot ordinary API failures.