Prepstellar
Get it on Google Play

AI-103 · Practice set 13 of 13

Configuring Agent Deployments: 10 practice questions

10 questions · Untimed · Free

10 free AI-103 practice questions on Configuring Agent Deployments, with an explanation for every answer. Untimed. The full mock exam and the timed version are in the app.

Set 13 · Configuring Agent Deployments · 10 questions Read the lesson

  1. Question 1 of 10

    A developer edits one sentence in a Foundry agent's instructions. What happens to the agent?

    1. AA new agent endpoint URL is issued
    2. BA new agent version is created
    3. CThe agent must be published again first
    4. DThe current version is updated in place
    Show the answer

    Agent versions are immutable records of the configuration, so any change, even one prompt edit, produces a new version. The agent itself, with its endpoint URL, stays the same; what it serves depends on the version selector.

    Next → 1 / 10

  2. Question 2 of 10

    Nobody has changed the version selector of an agent. Which version does its endpoint serve?

    1. AThe first version ever created
    2. BThe version that was last pinned
    3. CThe most recently created version
    4. DAn even split across all versions
    Show the answer

    The default routing policy is Always use latest: 100% of traffic goes to the most recently created version, so a new version is served immediately. Pinning is the opt-in alternative when you want stability.

    Next → 2 / 10

  3. Question 3 of 10

    A client team asks for an API key to call an agent's endpoint. How should callers be authorized instead?

    1. AWith the Foundry resource key passed in a header
    2. BWith an agent-level key rotated every 90 days
    3. CWith a project-level API key stored in Key Vault
    4. DWith Microsoft Entra ID and Azure RBAC roles
    Show the answer

    Agent endpoints don't support API key authentication at all. Callers authenticate with Microsoft Entra ID, and Azure RBAC decides what they may do, for example the Foundry Agent Consumer role for invoking.

    Next → 3 / 10

  4. Question 4 of 10

    An agent is published to Teams users. Developers keep creating new versions while they experiment. How do you make sure Teams users only see a version you approve?

    1. ASend 10 percent of traffic to each new version
    2. BPin the version selector to the approved version
    3. CKeep the default selector and test before saving
    4. DCreate a second agent for every new experiment
    Show the answer

    With the default selector, every new version is served immediately, including in Teams. Pinning routes 100% of traffic to the version you choose, and new versions don't change what's served until you update the selector.

    Next → 4 / 10

  5. Question 5 of 10

    Which endpoint configuration must an agent have before it is published to Microsoft 365 or Teams?

    1. AResponses protocol only, with the Entra scheme
    2. BA2A protocol, with BotServiceRbac or BotServiceTenant
    3. CInvocations protocol, with an API key for the channel
    4. DActivity protocol, with BotServiceRbac or BotServiceTenant
    Show the answer

    Microsoft 365 and Teams talk to agents through the Activity protocol used by Azure Bot Service, and their authorization schemes are BotServiceRbac or BotServiceTenant. The default setup, Responses with Entra, isn't enough for these channels.

    Next → 5 / 10

  6. Keep the ones you got wrong

    In the app, every question you miss comes back exactly when you’re about to forget it.

    Get it on Google Play

  7. Question 6 of 10

    After publishing an agent as a legacy Agent Application, tool calls that worked during development fail with authorization errors. What is the fix?

    1. AEnable the Activity protocol on the application
    2. BStart the application's deployment from stopped
    3. CReassign the RBAC roles to the new agent identity
    4. DGive callers the Foundry Agent Consumer role
    Show the answer

    Publishing gives the Agent Application its own Entra agent identity, separate from the project's shared one. Permissions don't transfer automatically, so tools that authenticate with agent identity fail until you reassign the roles to the new identity.

    Next → 6 / 10

  8. Question 7 of 10

    An agent must receive GitHub webhook payloads and run existing LangGraph code. Which option fits?

    1. AA prompt agent with the Activity protocol on
    2. BA hosted agent using the Responses protocol only
    3. CA hosted agent using the Invocations protocol
    4. DA prompt agent using the Responses protocol
    Show the answer

    Two signals point to hosted agents with Invocations: existing framework code, which a prompt-only definition can't run, and webhook payloads, which arrive in the sender's own format. Invocations accepts arbitrary JSON, unlike the OpenAI-compatible Responses contract.

    Next → 7 / 10

  9. Question 8 of 10

    A partner team must call your agent's endpoint, which uses the Entra scheme. They must not create or edit agents, and least privilege is required. Which assignment fits?

    1. AFoundry User on the Foundry project scope
    2. BFoundry Project Manager on the resource
    3. CAn API key shared with the partner team
    4. DFoundry Agent Consumer on the agent scope
    Show the answer

    With the Entra scheme, callers need Foundry Agent Consumer or a higher role on the project or agent scope. Consumer is the role meant for principals that only interact with agents, and scoping it to the agent keeps the grant as narrow as possible.

    Next → 8 / 10

  10. Question 9 of 10

    A project has public network access disabled. Its agent must be published to Teams, and every other agent protocol and project API must stay private. What should you configure?

    1. AEnable public network access on the account
    2. BAdd public ingress to the virtual network
    3. CDrop the Bot Service schemes for Teams
    4. DSet enable_m365_public_endpoint to true
    Show the answer

    Teams needs an endpoint routable over the public internet, and Microsoft 365 doesn't support private connectivity. Setting enable_m365_public_endpoint in the activity configuration opens only the Activity Protocol route, with source-IP filtering, while other protocols and project APIs stay private.

    Next → 9 / 10

  11. Question 10 of 10

    A hosted agent version runs at 2 vCPU with 4 GiB. Under many concurrent sessions, CPU and memory peaks stay far below that allocation, and costs are high. What should the team do?

    1. AEdit the CPU and memory of the current version
    2. BDeploy a new version with a smaller sandbox size
    3. CLower the replica count of the current version
    4. DRaise the idle timeout of the current version
    Show the answer

    CPU and memory describe a single session, and billing covers what all active sessions consume, so oversizing multiplies cost by concurrency. Versions are immutable, so the fix is a new version with a smaller allocation, retested afterwards.

    Next → 10 / 10

  12. You’ve finished this set

    That’s 10 questions on Configuring Agent Deployments. In the app the ones you miss come back exactly when you’re about to forget them.

    Back to the course Get it on Google Play
Get it on Google Play

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get it on Google Play

“This app is the ‘One Lake’ for preparing the certification exams. Really worth it.”

Abdelhak Y. Google Play review