AI-500 Exam Dumps and Practice Questions

Fraud-check, Policy-eligibility, and Document-summary are independent specialist activities, so running them concurrently reduces wall-clock time without changing their outputs. The Decision agent is different because the case study states that it depends on the results of those three agents. It therefore must execute only after the independent work completes. Microsoft Agent Framework's concurrent orchestration pattern is designed for independent participants whose results can be fanned in later, while dependency-driven work should remain ordered. Running all four agents concurrently would violate the Decision agent's data dependency. Running all four sequentially would preserve correctness but add unnecessary latency. Disabling memory would also change functionality unrelated to the performance bottleneck. The optimal graph is therefore a parallel fan-out of the three independent specialists followed by a fan-in and Decision step, which preserves behavior while minimizing end-to-end claim-approval duration. In production, add telemetry and regression tests around this behavior so changes to prompts, models, tools, or orchestration do not silently alter the intended contract. The selected approach is the one that best matches the platform's native execution semantics.

Official Microsoft reference: Microsoft Agent Framework - Concurrent orchestration

Creating one memory store for each end user separates users, but allowing both agents to use that user's store with the same static scope does not isolate the two agent domains. Memories produced by one agent can occupy the same logical collection as memories produced by the other agent. Microsoft Foundry Memory uses the `scope` parameter to partition a store, so a design that needs both user and domain isolation must preserve both dimensions, commonly through separate agent stores plus per-user scope. The per-user deletion requirement can also be handled more efficiently by deleting a user's scope rather than operating a separate store for every user. Because the proposed design fails agent-domain separation, it does not meet all requirements. Therefore B, No, is correct. In production, add telemetry and regression tests around this behavior so changes to prompts, models, tools, or orchestration do not silently alter the intended contract. The selected approach is the one that best matches the platform's native execution semantics.

Official Microsoft reference: Create and use memory in Foundry Agent Service

The tool only needs to read and write blob data in the `stgaudit` storage account. Storage Blob Data Contributor is the built-in data-plane role that grants the required blob read/write capabilities without granting unnecessary ownership or broad resource-management authority. Storage Account Contributor and the generic Contributor role operate at the management plane and are wider than necessary for this data-access requirement. Storage Blob Data Owner also exceeds the stated need by including additional control over blob data permissions/ownership. Microsoft's Azure Storage RBAC guidance separates data-plane blob roles from management roles and recommends choosing the narrowest role that supports the required operation. Because the agent must both read and write blob content, D is the least-privilege role among the options. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Azure Storage - assign Azure roles for blob data access

The business rule requires human review for refunds above the stated threshold before payment can continue. A workflow therefore needs a user or operator interaction point that pauses progress and obtains an explicit response. In the workflow options provided, Ask a question is the node that introduces that human interaction. Invoke agent simply delegates work to another agent; it does not itself guarantee human approval. Deliver a message sends information without collecting a decision, and Go to changes control flow without obtaining authorization. Microsoft Agent Framework and Foundry workflow guidance treat human-in-the-loop approval as a first-class orchestration requirement for consequential actions. The decisive requirement is not just to notify a reviewer, but to stop automated progression until the reviewer supplies a decision. Therefore the workflow must include an interactive question/approval step before the refund-processing action can proceed for amounts over the threshold. The implementation should also preserve clear inputs and outputs around this step so that later agents receive only the information they require. This improves debuggability and keeps token, permission, and state growth under control as the workflow becomes more complex.

Official Microsoft reference: Microsoft Agent Framework - Human-in-the-loop workflows

The three risks occur at three different intervention points. Direct jailbreak attempts originate in the user prompt, so User input attacks should be evaluated at the User input boundary and blocked. Malicious instructions embedded in retrieved documents are indirect prompt-injection attacks and belong at the Tool response boundary before the retrieved content can influence downstream reasoning. Protected material in the final response must be flagged for legal review, not necessarily blocked, so an Output control using annotate-only behavior matches the requirement. Options A and B misplace at least one control or block content that the scenario says should only be flagged. Microsoft Foundry guardrails are explicitly designed around these intervention points, making C the configuration that aligns each risk with the stage where it can be detected and acted upon. From a security and governance perspective, the control should be enforced at the narrowest platform boundary that can deterministically block or constrain the action. Relying only on prompt text is weaker because the model can still be induced to behave unexpectedly.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points