AI-103 Practice Questions and Answers: 15 Worked Examples (2026)

Question 1 (RBAC roles)

A managed identity needs to call a Microsoft Foundry project endpoint to run inference and use agents. Policy requires the least-privilege built-in role that grants data-plane access and nothing more. Which role fits?

• A. Cognitive Services Contributor
• B. Foundry User
• C. Azure AI Developer
• D. Foundry Account Owner

Correct answer: B. Foundry User.

Foundry User is the least-privilege built-in role for Foundry projects and provides the data-plane actions needed to call a project endpoint, run inference, and use agents. Microsoft's guidance is to assign the project's managed identity Foundry User on the Foundry resource.

Why the other options miss:

• A. Belongs to the older role family and manages AI Services resources — no data-plane access to a Foundry project endpoint.
• C. Scoped to Azure ML workspaces and Foundry hubs, not projects, so it doesn't fit a project endpoint scenario.
• D. Can create accounts, projects, and manage models, but skips the data actions needed here while over-granting control operations.

Rule of thumb: when a scenario says Foundry project endpoint and least privilege, the answer is almost always Foundry User.

Question 2 (Content Safety severity)

You configure Azure AI Content Safety to moderate user-uploaded images. A tester reports that an image returned a Violence severity of 3. Why is this result not possible?

• A. Content Safety moderates text only
• B. The image model returns only severity values 0, 2, 4, and 6
• C. Severity 3 is reserved for the Self-Harm category
• D. Image moderation returns only a binary blocked / allowed flag

Correct answer: B. The image model returns only 0, 2, 4, and 6.

The image model in Azure AI Content Safety uses a trimmed severity scale returning only 0, 2, 4, or 6, so an odd value like 3 can't appear. Odd severities exist only on the text model's 0–7 scale.

Why the other options miss:

• A. Content Safety covers text and images across all four harm categories.
• C. Severity values aren't reserved per category — all four categories share the same scale.
• D. Image moderation returns per-category severity, not a binary flag; blocking is compared against your threshold.

Memorise the asymmetry: text severity is 0–7, image severity is 0, 2, 4, 6. Any odd severity quoted for an image is a trap.

Question 3 (Keyless auth)

A production app authenticates to Microsoft Foundry using an API key in an environment variable. Security requires removing hardcoded secrets and enabling per-principal auditing. Which approach satisfies both?

• A. Store the API key in Azure Key Vault and rotate monthly
• B. Authenticate to Microsoft Entra ID with a managed identity (keyless)
• C. Share a single API key across services and restrict it by IP
• D. Embed the API key as a masked pipeline variable

Correct answer: B. Managed identity via Microsoft Entra ID.

Keyless auth with Entra ID issues short-lived OAuth tokens scoped per principal, eliminating hardcoded secrets and producing per-principal audit trails. A managed identity extends this to service-to-service calls without credentials in code.

Why the other options miss:

• A. Key Vault improves storage but the key still grants full access with no per-principal identity — fails the auditing requirement.
• C. A shared key can't attribute calls to individuals — the opposite of per-principal auditing.
• D. Masking hides values in logs but the secret still exists and still lacks a principal identity.

API keys sidestep RBAC and grant full access — when a scenario stresses auditing or secret elimination, choose keyless Entra ID auth.

Question 4 (Model deployment)

A team wants to deploy a Foundry catalogue model with the fastest possible setup, pay only for tokens consumed, and avoid provisioning any VM quota. Which deployment fits?

• A. Managed compute (managed endpoint)
• B. Serverless API deployment (models as a service, MaaS)
• C. Self-hosted on Azure Kubernetes Service
• D. A local container on a developer workstation

Correct answer: B. Serverless API deployment (MaaS).

Serverless API deployment runs on Microsoft-managed infrastructure, bills per input/output token, and requires no VM quota — the fastest path that matches token-based billing.

Why the other options miss:

• A. Provisions a dedicated VM billed per core-hour and needs VM quota — conflicts with both constraints.
• C. AKS requires substantial cluster setup, contradicting fastest-setup.
• D. Not a production deployment pattern.

Decision cue: serverless MaaS for token billing without quota; managed compute for dedicated capacity; Azure OpenAI deployments via the Foundry project endpoint for GPT-family models.

Question 5 (RAG vs fine-tuning)

A support agent must answer from an internal knowledge base updated weekly with new product docs, always reflecting the latest content. Which approach should you implement?

• A. Fine-tune the base model on new documents each week
• B. Retrieval-augmented generation (RAG) over an index of the docs
• C. Raise model temperature to improve recall of recent facts
• D. Apply Direct Preference Optimization (DPO) to the documents

Correct answer: B. Retrieval-augmented generation.

RAG injects fresh, frequently changing knowledge at inference time by retrieving relevant chunks from an index and grounding responses in them — the textbook "chat with your data" pattern.

Use fine-tuning when you need to change model behavior, style, or task performance — not to add fresh knowledge.

— Microsoft Learn, Foundry fine-tuning considerations

Why the other options miss:

• A. Fine-tuning changes behaviour or style, not what the model knows; weekly retraining is slow and expensive for that cadence.
• C. Temperature controls randomness, not knowledge.
• D. DPO aligns a model to preferences — a fine-tuning method, not knowledge injection.

When a scenario stresses frequently changing or private data plus grounded answers, choose RAG.

Question 6 (Agent components)

You define an agent in Microsoft Foundry Agent Service. It uses a catalogue model for reasoning, a system instruction that sets its goals, and a file-search capability over a knowledge store. Which three components does this represent?

• A. Endpoint, API key, deployment name
• B. Model, instructions, tools
• C. Trigger, action, condition
• D. Embedding, retriever, generator

Correct answer: B. Model, instructions, tools.

Foundry Agent Service defines every agent as three components: a model for reasoning, instructions that set goals and behaviour, and tools for data or actions. The scenario maps directly.

Why the other options miss:

• A. These are properties for authenticating to a deployed model, not the conceptual pieces of an agent.
• C. That's workflow automation (e.g. Power Automate), not Foundry Agent Service.
• D. Describes a RAG pipeline; an agent can use RAG via tools, but the agent itself is model + instructions + tools.

Question 7 (Responses API vs Assistants API)

In mid-2026 you're starting a brand-new agentic application on Azure and want to build on the GA, supported entry point for Foundry agents. Which API should you target?

• A. The Assistants API
• B. The Responses API via Foundry Agent Service
• C. The legacy text Completions API
• D. The LUIS runtime API

Correct answer: B. Responses API via Foundry Agent Service.

The Responses API is the GA single entry point for Foundry Agent Service and supports both prompt agents and hosted agents. It's the API Microsoft directs new agentic development toward.

Why the other options miss:

• A. Deprecated; retires 26 August 2026 — wrong foundation for a new project.
• C. A legacy text-completion interface with no agent orchestration or conversation management.
• D. Retired language service, not part of AI-103.

Question 8 (Evaluators)

You need an automated grounding check for a RAG application's continuous evaluation. It must return pass or fail and must not require deploying a separate judge model. Which evaluator?

• A. Groundedness (returns 1–5 score)
• B. Groundedness Pro
• C. Fluency
• D. Relevance

Correct answer: B. Groundedness Pro.

Groundedness Pro returns a binary pass/fail on the Azure AI Content Safety service, so you don't need to deploy a judge model. That matches both requirements.

Why the other options miss:

• A. Returns 1–5 using model-based judgement — requires a deployed judge and isn't binary.
• C. Measures natural-language quality, not grounding in retrieved context.
• D. Measures how well a response addresses the query — related but distinct from grounding.

Question 9 (Agent tools)

An agent must call your organisation's internal inventory system, exposed as a set of tools. You want tool definitions maintained centrally and reusable across several agents. Which Foundry capability fits?

• A. Add a Model Context Protocol (MCP) server as an agent tool
• B. Increase the model's context window
• C. Fine-tune the model on the inventory API schema
• D. Enable the code interpreter tool

Correct answer: A. Add an MCP server as an agent tool.

An MCP server exposes a reusable, centrally maintained tool set that multiple agents can share. Foundry Agent Service supports adding MCP servers from the tools catalogue for exactly this pattern.

Why the other options miss:

• B. Context window controls how much text the model considers — doesn't connect to an external system.
• C. Fine-tuning adjusts behaviour; it can't establish a live API connection.
• D. Runs sandboxed code but doesn't offer a maintained, reusable interface to the inventory API.

Question 10 (Content Understanding modes)

A finance team needs to extract named fields (invoice number, total) from invoices, with a per-field confidence score so low-confidence values can be routed to a human. Which Content Understanding mode fits?

• A. Pro mode
• B. Standard mode
• C. Either mode — both return confidence
• D. Neither — confidence requires Azure AI Document Intelligence

Correct answer: B. Standard mode.

Standard mode supports field extraction and returns confidence scores with grounding — exactly what a human-in-the-loop review workflow needs. Pro mode is designed for multi-step reasoning and omits confidence scoring.

Content Understanding pro mode currently doesn't offer confidence scores or grounding. It supports classify and generate fields, but not extract fields.

— Microsoft Learn, Content Understanding modes

Why the other options miss:

• A. Pro mode returns no confidence or grounding and doesn't support extract fields — can't drive a confidence-based review.
• C. Only standard mode returns confidence.
• D. Content Understanding standard provides per-field confidence natively — no need to fall back to Document Intelligence.

The frozen skills outline sometimes uses "single-task pipeline" while the current docs say "standard mode". Recognise them as the same idea.

Question 11 (Prompt Shields)

A multimodal agent processes user-uploaded images. An attacker embeds hidden instructions inside an image hoping the agent will act on them. Which Azure AI Content Safety capability is designed to detect this?

• A. A content filter set to High severity for Violence
• B. Prompt Shields (document and indirect prompt injection)
• C. Raise the analyser's image resolution threshold
• D. Disable the agent's file-search tool

Correct answer: B. Prompt Shields.

Prompt Shields detects prompt injection attacks, including indirect injection where malicious instructions are embedded in content the model processes — such as text hidden inside an image. The AI-103 outline calls out detecting indirect prompt injection from embedded text in images.

Why the other options miss:

• A. Content filters classify harm categories and severity — they don't spot instruction-injection attempts.
• C. Resolution has no bearing on detecting embedded instructions.
• D. Disabling a tool reduces functionality without detecting anything.

Content filters detect harmful content by category/severity. Prompt Shields detects attack attempts and returns a binary attack-detected flag.

Question 12 (Translation approach)

An app must translate a high volume of straightforward product descriptions into 20 languages quickly, consistently, and cheaply. There's no domain-specific nuance. Which approach fits best?

• A. An LLM translation flow with a custom system prompt
• B. Azure Translator in Foundry Tools
• C. A fine-tuned model for each of the 20 target languages
• D. Azure AI Document Intelligence

Correct answer: B. Azure Translator in Foundry Tools.

Azure Translator provides deterministic, broad-language translation at scale and at lower cost — the right fit for high-volume, straightforward content. LLM translation flows are better when translation is part of a richer reasoning pipeline or needs domain adaptation.

Why the other options miss:

• A. LLMs cost more, add latency, and are non-deterministic — unnecessary here.
• C. Per-language fine-tuning is expensive and slow to maintain with no benefit over a managed service on standard content.
• D. Document Intelligence extracts content from documents — it doesn't translate.

Question 13 (Speech as an agent modality)

You're building a voice agent for a pharmacy. It must accept spoken questions, reply with synthesised speech, and reliably recognise specialised medicine names that general speech models often misread. Which capability should you configure?

• A. A custom speech model for speech-to-text in the agent
• B. Only the default text-to-speech voice
• C. Azure Translator to convert the audio
• D. Azure AI Document Intelligence on the audio stream

Correct answer: A. A custom speech model for STT.

A custom speech model adapts speech-to-text to your domain vocabulary — the direct fix for specialised terms like medicine names. AI-103 covers integrating speech (including custom speech models) as an agent modality.

Why the other options miss:

• B. TTS handles output speech, not accurate input recognition.
• C. Translator converts text between languages — no bearing on domain-specific STT accuracy.
• D. Document Intelligence processes documents, not audio.

Question 14 (Document Intelligence vs Content Understanding)

A legal team extracts clauses and inferred fields from unstructured contracts. One required field — the contract end date — isn't stated explicitly and must be derived from the start date plus the term. They have no labelled training data. Which tool fits?

• A. An Azure AI Document Intelligence custom model trained on labelled samples
• B. Azure Content Understanding using a prebuilt-contract or zero-shot custom analyser
• C. The Azure AI Search semantic ranker
• D. Azure Translator in Foundry Tools

Correct answer: B. Azure Content Understanding.

Content Understanding handles unstructured documents, works zero-shot without labelled data, and can infer fields not explicitly present — such as deriving an end date from start date plus term. That matches every requirement.

Why the other options miss:

• A. Document Intelligence custom models need labelled samples, target structured/templated forms, and extract only what's explicitly present.
• C. The semantic ranker reorders search results — it doesn't extract fields.
• D. Translator translates; it doesn't extract fields.

Question 15 (Agentic retrieval)

A RAG application must answer multi-hop questions that require combining information from several documents and refining the search across steps. Which retrieval configuration should you choose?

• A. Standard vector search with a single top-k retrieval
• B. Agentic retrieval that plans and iterates queries against Azure AI Search
• C. Keyword-only BM25 with no reranker
• D. Disable retrieval and rely on the model's parametric knowledge

Correct answer: B. Agentic retrieval.

Agentic retrieval lets the system plan, decompose, and iterate its queries against the index — the pattern designed for multi-hop questions where a single top-k pass won't return everything needed.

Why the other options miss:

• A. One-shot top-k typically misses evidence for multi-hop questions.
• C. Keyword-only without reranking is weak for semantic multi-hop queries.
• D. Removes grounding entirely — the opposite of what a RAG scenario requires.