This is the first practice set for AI-103, the Azure AI Apps and Agents Developer Associate exam. AI-103 replaced AI-102, which retired on June 30, 2026, and its focus has moved firmly toward generative AI and agents. The largest area of the exam, Implement generative AI and agentic solutions, is worth 30-35%, and planning and securing those solutions adds another 25-30%.
Questions 1-10 cover the foundations of building agents in Microsoft Foundry: choosing the right platform and agent type, sharing knowledge and tools across agents, long-running workflows, roles, guardrails, and running hosted agents safely and cheaply. Every question is an original practice scenario mapped to the official skills outline, not a copy of a real exam item.
Commit to an answer before you reveal it. The explanations cover why each wrong option fails, which is where most exam points are won.
Question 1: Choosing the Right Agent Platform
Contoso’s engineering team writes Python every day. For its first production agent, it needs full control over model choice, retrieval, tools, evaluation, and OpenTelemetry tracing, and it will deploy through its own CI/CD pipelines. Which Microsoft platform fits best?
A) Microsoft Copilot Studio, because it is the fastest way to build any agent
B) Power Automate cloud flows that call a model through an HTTP action
C) Microsoft Foundry Agent Service with the Foundry SDK
D) A SharePoint list that stores prompts and answers
👁 Reveal Answer
Correct Answer: C
Explanation: Foundry Agent Service is Microsoft’s pro-code platform for agents. Developers choose the model, attach tools and knowledge, run evaluations, trace runs with OpenTelemetry, and automate deployment from code, which matches every requirement. A is a low-code platform aimed at makers; it is quick to start but does not give this team the depth of control it asked for. B can call a model but has none of the agent building blocks such as tools, conversations, or evaluations. D stores data; it is not an agent platform.
Reference: Microsoft Foundry SDKs and endpoints
Question 2: Bringing an Existing LangGraph Agent
Tailwind Traders already has an agent written with LangGraph. Each user session writes working files that must still be there when the user returns later in the day. Ops wants a managed runtime with isolation between sessions and no cost for compute while sessions are idle, without rewriting the agent. What should they use?
A) A hosted agent in Foundry Agent Service, deployed from a container image in Azure Container Registry
B) A prompt agent defined only with instructions and tools in the Foundry portal
C) An Azure Kubernetes Service cluster that the team runs itself
D) An App Service plan with one always-on instance
👁 Reveal Answer
Correct Answer: A
Explanation: Hosted agents run your own code from any framework (Agent Framework, LangGraph, Semantic Kernel, or custom) packaged as a container image. Each session gets its own VM-isolated sandbox with a persistent file system. After a configurable idle timeout, compute is released and session state is saved, then restored when the session resumes. Billing is based on CPU and memory used during active sessions. B cannot run existing LangGraph code, because prompt agents are defined by instructions and tool settings. C works but puts all operations back on the team. D keeps paying while idle and does not isolate sessions.
Reference: Hosted agents in Foundry Agent Service
Question 3: One Knowledge Source for Many Agents
Fabrikam is building an HR agent, an IT agent, and a facilities agent. All three need the same company content from SharePoint, Azure Blob Storage, and OneLake, and answers must respect each user’s existing permissions. The team does not want every agent to build its own ingestion pipeline. What should they set up?
A) A nightly Azure Data Factory job that copies all files into one public container
B) A separate file search vector store for each agent, with the same files uploaded three times
C) A custom tool for each agent that calls Microsoft Graph and filters results in code
D) A Foundry IQ knowledge base with knowledge sources for those stores, shared by all three agents
👁 Reveal Answer
Correct Answer: D
Explanation: Foundry IQ is a managed knowledge layer. A knowledge base combines knowledge sources such as Blob Storage, SharePoint, OneLake, and web data, and multiple agents can share the same knowledge base. For supported sources it can synchronize access control lists and run queries under the caller’s identity, so users only get content they are allowed to see. A removes permissions entirely and goes stale between runs. B triples the work and the storage, and file search is meant for documents you upload, not synchronized enterprise sources. C means writing and maintaining permission logic three times.
Reference: What is Foundry IQ?
Question 4: A Mortgage Approval That Takes Days
Woodgrove Bank is building a multi-agent mortgage process. It runs for several days, must pause for an underwriter’s approval, and must continue from where it stopped if the process restarts. The team is starting the project now. Which approach fits?
A) Build it in the Foundry portal’s visual workflow designer
B) Build it as a Microsoft Agent Framework workflow that uses checkpoint storage and a request-and-response step for the underwriter’s approval
C) Ask one agent to remember the process state in its instructions
D) Schedule an evaluation run every hour to check progress
👁 Reveal Answer
Correct Answer: B
Explanation: Agent Framework workflows save checkpoints at the end of each step, including executor state, pending messages, and pending requests, and they can resume from storage such as Azure Cosmos DB after a restart. A request-and-response step pauses the workflow until a person answers, and pending requests are re-emitted when you restore a checkpoint. A is the wrong choice for a new project: Microsoft is retiring the Foundry workflows designer on December 1, 2026 and recommends Agent Framework for new workflows. C has no durable state. D measures quality; it does not run anything.
Reference: Agent Framework: checkpointing and resuming workflows
Question 5: Reusing the Same Tools Across Agents
Northwind has twelve agents that use the same set of tools: an inventory MCP server, a pricing API, and web search. Today each agent configures and authenticates these tools separately, and every change to a tool means updating twelve agents. What should the team use?
A) A Toolbox in Foundry, which defines the tools once and exposes them through a single MCP-compatible endpoint
B) Copy the tool definitions into each agent’s instructions
C) Replace the tools with one function called do_everything
D) Put an Azure API Management policy in front of the model to rewrite its answers
👁 Reveal Answer
Correct Answer: A
Explanation: Toolbox lets you define a curated set of tools once and expose them through one MCP-compatible endpoint. It centralizes authentication, governance, and access control, and Microsoft notes that you can update tool implementations without changing agent code. B does not give the model working tools; it only describes them. C gives the model nothing useful to choose from and hides what each call does. D rewrites traffic but does not provide or manage tools.
Reference: Toolbox overview
Question 6: Least Privilege for an App That Calls an Agent
A customer website’s backend uses a managed identity to send messages to one published agent. It never creates, edits, or publishes agents. Following least privilege, which role should the identity get?
A) Contributor on the resource group
B) Foundry Project Manager on the project
C) Foundry Agent Consumer, scoped to that agent if possible
D) Foundry User on the project
👁 Reveal Answer
Correct Answer: C
Explanation: Microsoft describes Foundry Agent Consumer as the least-privilege role for principals that only need to interact with agents, and it can be assigned at the scope of a single agent. A is a control-plane role: it can create resources and deploy models but cannot build in a project or interact with agent endpoints. B can manage projects and publish agents, which is far more than needed. D includes building and developing, so it is broader than necessary. Remember that roles only apply to Microsoft Entra ID authentication; an API key grants full access without role restrictions.
Question 7: Which Guardrail Does the Agent Use?
A model deployment has a guardrail with Violence set to High (most restrictive). A developer creates a custom guardrail with Violence set to Low and assigns it to an agent that uses that deployment. The security team assumes the agent still gets the deployment’s stricter setting. What actually happens?
A) The stricter of the two settings always wins
B) The two guardrails are merged, and each risk uses the average setting
C) Guardrails apply only to models, so the agent has no guardrail
D) The agent’s assigned guardrail fully overrides the model deployment’s guardrail, so Violence is checked at the Low setting for that agent
👁 Reveal Answer
Correct Answer: D
Explanation: Microsoft’s documentation states that risks are detected in an agent based on the guardrail assigned to it, not the guardrail of its underlying model, and that the agent’s guardrail fully overrides the model’s. Only when no custom guardrail is assigned does the agent inherit the deployment’s guardrail. A and B describe behavior that does not exist. C is wrong because agent guardrails (in preview) can scan user input, tool calls, tool responses, and output. The lesson: review agent guardrails directly instead of assuming the model’s settings carry over.
Reference: Guardrails in Microsoft Foundry
Question 8: Secrets in a Hosted Agent
A hosted agent must read files from a storage account and call an internal API. A developer plans to put the storage key and the API secret into environment variables in the container image. What should the team do instead?
A) Encode the secrets in Base64 before adding them to the image
B) Use the agent’s own Microsoft Entra identity with role assignments on the storage account, and keep any remaining secrets in project connections or a managed secret store
C) Store the secrets in the agent’s instructions so the model can pass them to tools
D) Make the storage account public so no key is needed
👁 Reveal Answer
Correct Answer: B
Explanation: When a hosted agent is deployed, Agent Service assigns it a dedicated Microsoft Entra ID agent identity. Microsoft’s guidance is to treat a hosted agent like production code: do not put secrets in container images or environment variables, and use managed identities, connections, and a managed secret store instead. Granting the agent identity a data role on the storage account removes the key completely. A is encoding, not protection. C exposes secrets to the model and to anyone who can read its context. D trades a secret problem for a data exposure problem.
Reference: Hosted agents in Foundry Agent Service (security guidance)
Question 9: A Developer Who Cannot Publish
A developer with the Foundry User role on a project has built and tested an agent. When she tries to publish it for users, the action is denied. What is the most likely reason, and what is the fix?
A) Her role is too high; switch her to Foundry Agent Consumer
B) The agent has too many tools; remove some before publishing
C) Publishing requires at least the Foundry Project Manager role, so a project manager must publish it or grant her that role
D) Publishing requires the Contributor role on the subscription
👁 Reveal Answer
Correct Answer: C
Explanation: Foundry User covers building and testing agents, but Microsoft states that publishing agents needs the Foundry Project Manager role at minimum. A goes the wrong way, because Agent Consumer can only interact with agent endpoints. B is unrelated to permissions. D is a control-plane role that cannot even build in a project or interact with agent endpoints, so it would not help.
Question 10: A Hosted Agent That Costs Too Much
A hosted agent serves about 300 concurrent sessions at peak. Each session uses the largest sandbox size (2 vCPU, 4 GiB), but monitoring shows each session rarely uses more than a quarter of a CPU. The monthly bill is much higher than expected. What change will lower cost most directly?
A) Choose a smaller sandbox size that still meets the agent’s needs, because billing is based on CPU and memory across all active sessions
B) Add more replicas so each session finishes faster
C) Disable the idle timeout so sessions never restart
D) Switch the agent from the Responses protocol to the A2A protocol
👁 Reveal Answer
Correct Answer: A
Explanation: Hosted agents scale per session, and billing is based on the CPU and memory consumed across all active sessions. Microsoft warns that oversizing multiplies cost by your concurrency, so with 300 sessions an oversized sandbox is expensive. Smaller sizes (0.5 vCPU/1 GiB and 1 vCPU/2 GiB) are available. B does not apply, because there is no replica count to configure. C is not available, since the idle timeout ranges from 2 to 60 minutes, and longer idle sessions would cost more, not less. D changes how clients talk to the agent, not the compute it uses.
Reference: Hosted agents in Foundry Agent Service
Study Tips for Building Agents in Foundry
- Pick the platform by who builds it. Copilot Studio suits low-code makers; Foundry Agent Service suits developers who need full control.
- Prompt agent or hosted agent? Instructions and tools only: prompt agent. Your own code, framework, protocol, or stateful files: hosted agent.
- Share instead of copying. Foundry IQ shares knowledge across agents, and Toolbox shares tools.
- Know the roles. Agent Consumer calls agents, Foundry User builds them, Project Manager publishes them, and Contributor manages resources but not data.
- Check what is being retired. Connected agents are not available in the new Agent Service, and the Foundry workflows designer retires on December 1, 2026. Use A2A, Agent Framework orchestrations, or hosted agents instead.
Keep Practicing for AI-103
Continue with AI-103 Questions 11-20 on planning, securing, and monitoring Foundry solutions. The series currently runs to Question 70 and covers every area of the official AI-103 study guide.