Skip to content
Cheat sheets

AI-103 · Domain 1: Plan and manage an Azure AI solution · 28% of the exam

Task 1.2: Set up AI solutions in Foundry

The Azure resources behind an AI app or agent, the deployment types and options for models and agents, and wiring a Foundry project into a CI/CD pipeline.

Study it

  • Foundry resources and projects, and the Azure infrastructure around them

    Lesson coming

  • Deployment types: Global, Data Zone and regional; standard, provisioned and batch

    Lesson coming

  • Configuring model and agent deployments, and CI/CD for Foundry projects

    Partly covered by: From Pilot to Production

Sample questions

Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.

Question 1 · choose 1

A retailer in Germany is deploying a chat model in Microsoft Foundry. Its data protection officer requires that prompts and responses are processed only inside the EU. Traffic is bursty and modest, so the team wants to pay per token, and it wants higher default quota than single-geography deployment types offer. Which deployment type should it choose?

  1. AGlobal Standard, in a region in Germany
  2. BData Zone Provisioned, in a region inside the EU data zone
  3. CGlobal Batch, with requests sent from an EU region
  4. DData Zone Standard, in a region inside the EU data zone
Show the answer and why

  • AGlobal Standard, in a region in Germany

    Incorrect

    Global types may process inference data in any Azure region, even when the resource sits in Germany.

  • BData Zone Provisioned, in a region inside the EU data zone

    Incorrect

    This keeps processing in the EU, but it isn't billed per token, which the team wants for modest, bursty traffic.

  • CGlobal Batch, with requests sent from an EU region

    Incorrect

    Global Batch may process data in any Azure region, and a batch deployment doesn't answer chat requests as they arrive.

  • DData Zone Standard, in a region inside the EU data zone

    Correct

    Data Zone Standard is pay-per-token and processes prompts and responses only within the Microsoft-defined data zone, here the EU.

Two choices make the decision: where data is processed (global, data zone or Azure geography) and how you pay (per token or reserved). EU-only processing with per-token billing is Data Zone Standard.

Microsoft documentation

Task 1.2Report a problem with this question

Question 2 · choose 1

A bank is preparing Foundry Agent Service for production. Its security policy says that agent conversation history, uploaded files and vector stores must be stored in Azure resources the bank owns, in its own tenant. How should the agent environment be set up?

  1. AUse the basic agent setup and turn on customer-managed keys for the Foundry resource
  2. BUse the basic agent setup and export each conversation to the bank's database nightly
  3. CCreate a hub-based project in the Foundry (classic) portal for the agents
  4. DUse the standard agent setup with Cosmos DB, Storage and Azure AI Search the bank owns
Show the answer and why

  • AUse the basic agent setup and turn on customer-managed keys for the Foundry resource

    Incorrect

    The basic setup keeps agent state in Microsoft-managed resources. Your own keys change how data is encrypted, not where it is stored.

  • BUse the basic agent setup and export each conversation to the bank's database nightly

    Incorrect

    The data would still sit in Microsoft-managed storage between exports, which the policy doesn't allow.

  • CCreate a hub-based project in the Foundry (classic) portal for the agents

    Incorrect

    Hub-based projects are the classic model; new agent work targets Foundry projects, and a hub alone doesn't move agent state.

  • DUse the standard agent setup with Cosmos DB, Storage and Azure AI Search the bank owns

    Correct

    Standard setup stores conversations in your Cosmos DB, files in your storage account and vector stores in your Azure AI Search resource.

The standard agent setup is the bring-your-own-resources option: Cosmos DB for conversations and agent metadata, Azure Storage for files and Azure AI Search for vector stores, with project-level isolation by default.

Microsoft documentation

Task 1.2Report a problem with this question

Question 3 · choose 1

A claims app runs on a Standard deployment of a model version that the compliance team has validated. The team wants to keep that exact version for as long as it is supported, but the app must not stop working on the day the version is retired. Which version upgrade policy should the deployment use?

  1. AUpdate automatically once the current version expires
  2. BOpt out of automatic model version upgrades
  3. CUpdate automatically once a new default version becomes available
  4. DMove the deployment to a provisioned type so that the version is fixed
Show the answer and why

  • AUpdate automatically once the current version expires

    Correct

    The deployment stays on the validated version and moves to the new default only when that version is retired, so it keeps working.

  • BOpt out of automatic model version upgrades

    Incorrect

    With no automatic upgrade the deployment stays put, but it stops working when the version is retired.

  • CUpdate automatically once a new default version becomes available

    Incorrect

    This changes the version as soon as a new default ships, before the team has had any reason to accept it.

  • DMove the deployment to a provisioned type so that the version is fixed

    Incorrect

    The upgrade policy options apply to Standard deployment types; switching to provisioned changes billing, not this requirement.

The upgrade policy decides when a deployment changes version: never (manual, breaks at retirement), when a new default arrives, or when the current version expires. Only the last keeps a pinned version and avoids the retirement outage.

Microsoft documentation

Task 1.2Report a problem with this question

Question 4 · choose 1

Developers change a Foundry agent's instructions through pull requests in GitHub. Before a change merges, the pipeline must run a fixed set of test queries against the new agent version and the current one, and show whether quality changed significantly. What should you add to the workflow?

  1. AThe Foundry agent evaluation GitHub Action, comparing both agent versions
  2. BA stricter guardrail on the new version that blocks weak answers
  3. CManual spot checks of a few conversations in the agents playground
  4. DAn Azure Monitor alert on the agent's response latency after deployment
Show the answer and why

  • AThe Foundry agent evaluation GitHub Action, comparing both agent versions

    Correct

    The action runs the queries against each listed agent version, scores them with chosen evaluators and reports statistical significance against the baseline agent.

  • BA stricter guardrail on the new version that blocks weak answers

    Incorrect

    Guardrails filter harmful content; they don't score answer quality against a baseline version.

  • CManual spot checks of a few conversations in the agents playground

    Incorrect

    A handful of manual checks isn't a fixed test set, gives no statistics and doesn't run in the pipeline.

  • DAn Azure Monitor alert on the agent's response latency after deployment

    Incorrect

    Latency alerts fire after release and say nothing about answer quality on the test set.

Offline evaluation belongs in the pipeline: a dataset of queries, a list of evaluators, and the agent versions to compare. The GitHub Action returns confidence intervals and significance tests so a reviewer can tell real changes from noise.

Microsoft documentation

Lesson: From Pilot to ProductionTask 1.2Report a problem with this question

Question 5 · choose 1

A startup is prototyping a chat feature. It has no data residency requirements, its traffic is unknown, and it wants new models first at the lowest price. Which deployment type should it start with?

  1. AData Zone Standard
  2. BStandard (regional)
  3. CGlobal Standard
  4. DData Zone Provisioned
Show the answer and why

  • AData Zone Standard

    Incorrect

    No data zone is required, and new models launch on Global first.

  • BStandard (regional)

    Incorrect

    Geography-based types arrive last for new models and can have lower throughput.

  • CGlobal Standard

    Correct

    Global Standard launches first for new models, has the lowest price and the broadest region coverage.

  • DData Zone Provisioned

    Incorrect

    Nothing here requires a data zone or a capacity commitment.

The guidance is to start with Global Standard and move to another type only when you have a specific reason to.

Microsoft documentation

Task 1.2Report a problem with this question

Question 6 · choose 1

A company's apps call an Azure OpenAI resource through its endpoint and keys. It now wants Foundry Agent Service and Foundry Tools, but changing endpoints in dozens of apps would be costly. What should it do?

  1. AUpgrade the existing Azure OpenAI resource to a Foundry resource
  2. BCreate a new Foundry resource and move every app to its endpoint
  3. CCreate a hub-based project in the Foundry (classic) portal
  4. DAdd a project connection from the Azure OpenAI resource to agents
Show the answer and why

  • AUpgrade the existing Azure OpenAI resource to a Foundry resource

    Correct

    The upgrade keeps the resource name, endpoint, API key, network and identity settings and existing state.

  • BCreate a new Foundry resource and move every app to its endpoint

    Incorrect

    That is the endpoint change the company wants to avoid.

  • CCreate a hub-based project in the Foundry (classic) portal

    Incorrect

    Hub-based projects aren't where new agent work goes, and this doesn't change the resource's capabilities.

  • DAdd a project connection from the Azure OpenAI resource to agents

    Incorrect

    A standalone Azure OpenAI resource doesn't get Agent Service through a connection.

Upgrading converts an Azure OpenAI resource into a Foundry resource while preserving its configuration. Check limitations first, such as resources with private endpoints or customer-managed keys.

Microsoft documentation

Task 1.2Report a problem with this question

Question 7 · choose 1

A team ships its hosted agent as a .zip of Python source with remote build, and it has no container registry. The next release adds a private, wheels-only package that the service can't install from requirements.txt, so the new version stays in creating and then fails. What should the team change?

  1. APin an older version of the package in requirements.txt
  2. BBundle Windows wheels built on the developers' laptops
  3. CRepost the same zip so that the service retries the build
  4. DSwitch to bundled mode and ship prebuilt Linux packages in the zip
Show the answer and why

  • APin an older version of the package in requirements.txt

    Incorrect

    Remote build still has to install that package from requirements.txt in the cloud; private or wheels-only dependencies are the case the guidance sends to bundled mode.

  • BBundle Windows wheels built on the developers' laptops

    Incorrect

    The runtime is Linux x86_64, so Windows binaries in the zip cause import failures; prebuilt packages must target Linux.

  • CRepost the same zip so that the service retries the build

    Incorrect

    Versioning is content-addressable: an identical repost returns the existing latest version instead of building a new one.

  • DSwitch to bundled mode and ship prebuilt Linux packages in the zip

    Correct

    With dependency_resolution set to bundled, the zip runs as-is, with prebuilt Linux dependencies in packages/, so no server-side install is needed.

Source-code deployment offers two dependency modes: remote_build installs dependencies during provisioning, and bundled runs the zip as-is. Use bundled for reproducible builds or dependencies the service can't restore, built with a Linux platform tag.

Microsoft documentation

Task 1.2Report a problem with this question

Question 8 · choose 1

A regulator requires that data a Foundry resource persists is encrypted with keys the company controls and can revoke. Microsoft-managed encryption alone isn't enough. What should the team configure?

  1. ACustomer-managed keys kept in Azure Key Vault or Managed HSM
  2. BA Key Vault connection that stores the resource's API keys
  3. CA private endpoint for the Foundry resource and its projects
  4. DThe Developer deployment type for every model in the resource
Show the answer and why

  • ACustomer-managed keys kept in Azure Key Vault or Managed HSM

    Correct

    Foundry encrypts data at rest by default and supports customer-managed keys from Key Vault or Managed HSM for extra control.

  • BA Key Vault connection that stores the resource's API keys

    Incorrect

    Storing API keys in Key Vault protects credentials, not data at rest.

  • CA private endpoint for the Foundry resource and its projects

    Incorrect

    Network settings don't change who holds the encryption key.

  • DThe Developer deployment type for every model in the resource

    Incorrect

    Deployment types don't change encryption.

Customer-managed keys add a layer of control on top of default encryption. Support differs by capability and by where state is stored, so check each feature you rely on.

Microsoft documentation

Task 1.2Report a problem with this question

Question 9 · choose 1

An internal claims app has run on a prompt flow deployment since 2025. In October 2026 the platform team reviews the app's dependencies and wants a supported path before the app's next major release. What should it plan?

  1. AKeep the flow and pin the current prompt flow runtime image
  2. BMigrate the flow to Microsoft Agent Framework before April 20, 2027
  3. CExport the flow and run it in the prompt flow VS Code extension
  4. DRedeploy the flow as an Azure Machine Learning endpoint instead
Show the answer and why

  • AKeep the flow and pin the current prompt flow runtime image

    Incorrect

    Prompt flow runtime images no longer get updates, including security updates, and support ends at retirement.

  • BMigrate the flow to Microsoft Agent Framework before April 20, 2027

    Correct

    Prompt flow retires on April 20, 2027, and the notice directs existing applications and deployments to Microsoft Agent Framework.

  • CExport the flow and run it in the prompt flow VS Code extension

    Incorrect

    The retirement also covers the prompt flow VS Code extensions.

  • DRedeploy the flow as an Azure Machine Learning endpoint instead

    Incorrect

    The retirement applies to prompt flow in Azure Machine Learning as well as in Microsoft Foundry.

Lifecycle reviews should act on retirement notices early. Prompt flow is no longer recommended for new development, and its authoring experience, extensions and runtime images all end on the same date; the migration guide maps flows to Agent Framework.

Microsoft documentation

Task 1.2Report a problem with this question

Practise domain 1 →Practise all domains →