Secure, govern, and deploy multi-agent solutions (20–25%)

Microsoft Certified: Multi-Agent AI Solutions Expert · 66 questions

• Multiple agents need database credentials and third-party API secrets. Developers currently paste secrets into agent environment variables in plain text and rarely rotate them. Which approach meets security requirements for multi-agent solutions on Azure?
• A bank is preparing to launch a multi-agent customer assistant. Security wants shift-left adversarial testing of prompt injection, tool abuse, and jailbreak attempts before production. Which Foundry-aligned practice should they adopt?
• An enterprise multi-agent system must block toxic user inputs, prevent disallowed tool calls, validate tool responses before they re-enter the model, and filter unsafe final answers. Security rejects a single check only on the final response. What guardrail strategy should you design?
• A multi-agent expense system must call a user’s personal calendar and expense APIs using that user’s permissions—not a superuser service account—so agents cannot read other employees’ data. Which authentication approach is most appropriate?
• Platform engineering must release a new orchestrator version that changes tool-routing logic. They want limited blast radius, fast rollback, and production traffic validation—not a big-bang cutover. Which release methodology best fits?
• In a hub-and-spoke multi-agent design, the research subagent only needs read access to a knowledge index, while the payment subagent needs to initiate refunds. Security requires preventing lateral movement if the research agent is compromised. What identity design should you apply?
• A team deploys multi-agent infrastructure and prompt/tool packages by clicking in the Azure portal and copying files over SSH. Releases are inconsistent across environments. What CI/CD approach should they adopt?
• A healthcare multi-agent assistant must never output controlled substance dosage advice or attempt to schedule procedures that require clinician approval. Built-in generic content filters are helpful but incomplete for these clinical policies. What should the team implement?
• A multi-agent platform in a regulated tenant must ensure model endpoints, vector stores, and tool backends are not reachable from the public internet, while agents still call them securely from Azure. Which design best matches Zero Trust network boundaries?
• A canary of a new planner prompt set caused a spike in unsafe tool invocations. Automated gates paused expansion. What should the release design specify next for multi-environment multi-agent deployments?
• Security wants proof that new multi-agent guardrails block prompt injection and disallowed tool combinations before production. Production traffic is sparse and cannot supply enough attack variety. Which testing approach should they use?
• You must reduce prompt injection and unsafe tool use in a multi-agent Foundry deployment. Security asks for defense in depth across the agent pipeline. Which guardrail strategy is most appropriate?
• A financial services firm is deploying a multi-agent claims workflow in Microsoft Foundry. Three specialized agents must call different backend APIs: a document-extraction agent, a policy-lookup agent, and a payout-recommendation agent. Security requires that a compromised agent cannot call APIs outside its role. You must enforce least privilege without embedding long-lived secrets in agent configuration. Which approach best meets these requirements?
• You are building a multi-agent assistant that helps employees query their own Microsoft Graph mail and calendar. Downstream tools must only see data the signed-in user is already allowed to access. Agents run as Azure-hosted services and call Graph on the user’s behalf. Which authentication pattern should you implement for the agent-to-Graph calls?
• A multi-agent order-fulfillment system stores third-party shipping API credentials and signing certificates used by tool connectors. Compliance requires centralized secret storage, role-based access to secrets, automated rotation, and encryption at rest. Agents run on Azure with managed identities. Which design best satisfies these requirements?
• Your platform team wants to catch prompt-injection, tool-abuse, and jailbreak risks in a multi-agent Foundry solution before production release. They already run unit and integration tests in CI. Which shift-left security practice best extends that pipeline for agentic threats?
• A multi-agent customer-support system can read knowledge bases, call refund tools, and generate customer-facing replies. Risk review found that harmful content can enter via user chat, malicious tool payloads, or model-generated text. Leadership wants layered controls, not a single filter at the end. Which guardrail strategy best matches multi-intervention design?
• A hospital is piloting multi-agent triage helpers that draft clinical summaries. Beyond generic content safety, policies forbid diagnosing rare conditions without clinician review, forbid prescribing language, and require PHI redaction before any external tool call. How should you implement these requirements?
• You must roll out a major change to a multi-agent orchestration graph (new planner prompt, updated tool schemas, and a new subagent). Leadership wants limited user blast radius, fast rollback, and production traffic validation—not only lab evaluations. Which release methodology best fits?
• Your organization manages multi-agent solutions across Dev, Test, Acceptance, and Production. Agent definitions, MCP tool registrations, Azure resources, and evaluation suites must stay consistent and auditable. Which CI/CD approach best meets multi-environment release requirements?
• A regulated enterprise deploys multi-agent workloads that call Azure OpenAI-compatible model endpoints, Azure AI Search, and internal APIs. Policy forbids public ingress to data-plane services where private connectivity is available. Agents run on Azure Container Apps. Which network design best aligns with resource access and network boundary controls?
• After implementing multi-stage guardrails for a multi-agent procurement assistant, the security team needs evidence that the controls block known attack classes before each release. Production traffic is sparse for rare jailbreaks. What is the best validation approach?
• A multi-agent system previously used one shared service principal for the orchestrator and all specialist agents to call Azure resources and tools. A security assessment flags lateral movement risk if any agent is compromised. What should you implement?
• An assistant agent must call a downstream Microsoft Graph API to read only the signed-in user’s calendar. Compliance forbids the agent from using an app-only permission that can read all calendars in the tenant. Which authentication flow should you design?
• Specialist agents need database credentials and third-party API keys at runtime. Today secrets are environment variables baked at deploy time and rarely rotated. How should you design secrets management?
• Before production, security wants proactive adversarial testing of the multi-agent system for prompt injection, tool abuse, and jailbreaks. You are implementing shift-left security in Microsoft Foundry. Which approach best aligns?
• A regulated multi-agent assistant must block toxic user inputs, prevent disallowed tool calls, sanitize untrusted tool responses, and filter unsafe final answers. A single output filter has been bypassed by malicious tool-return content influencing the model. What guardrail strategy should you implement?
• A healthcare multi-agent system must never recommend changing prescribed medications and must refuse diagnosis claims. Built-in generic safety filters help but do not encode this clinical policy. What should you add?
• You implemented multi-stage guardrails but lack evidence they hold against creative bypasses. QA has limited real incident data. How should you validate guardrails?
• You are releasing a new orchestrator graph that changes tool-routing logic. Full big-bang production cutover is considered too risky. Traffic is sticky per session. Which release methodology best fits?
• Your DTAP pipeline promotes multi-agent configs (prompts, tool allowlists, model deployment references) as versioned artifacts. A production canary shows elevated tool-failure rates after promotion. What rollback design should already be in place?
• A platform team wants CI for a multi-agent repo. Engineers currently only run occasional manual chat trials. Which testing strategy should you specify for integration and release?
• You must deploy Foundry-related infrastructure, agent configurations, and guardrail policies consistently across Dev, Test, Acceptance, and Production. Drift between environments caused a production-only outage last quarter. What CI/CD requirement should you specify?
• A multi-agent expense system must call a line-of-business API that authorizes actions based on the signed-in employee's identity and group memberships. The orchestrator and tools currently use a single long-lived application secret with broad application permissions, so every agent acts with the same superuser power. Which authentication design best aligns with least privilege for user-scoped actions?
• A customer-facing multi-agent concierge can read email, call booking tools, and generate replies. Red-team tests show jailbreak text sometimes reaches tools, tool responses sometimes contain competitor-injected spam, and final replies sometimes leak internal system instructions. Which guardrail strategy best matches a multi-intervention design?
• Several Foundry agents retrieve third-party API keys and certificates at runtime. Today secrets are stored in a shared configuration map baked into container images, and rotation requires rebuilding every agent image. Which approach best meets secrets management requirements for multi-agent solutions on Azure?
• A platform team wants shift-left security for a new multi-agent claims workflow before the first production canary. They already run dependency scanning on infrastructure code. Which additional practice best targets agent-specific abuse paths such as prompt injection and tool misuse?
• A team must ship a risky orchestrator prompt change that alters how three specialist agents are sequenced. Automated evals look good in staging. They need a production release method that limits blast radius if live behavior diverges. Which release methodology best fits?
• In a Zero Trust multi-agent design, a low-privilege FAQ agent was compromised via prompt injection and attempted to invoke the wire-transfer tool bound only to a payments agent. The tool call succeeded because both agents shared one managed identity with contributor rights on all tools. What architectural fix best prevents this lateral movement?
• A pharmaceutical multi-agent system must never recommend off-label drug uses or invent clinical claims. Generic toxicity filters catch insults but miss domain violations. How should the team design guardrails and validation?
• An operations team deploys multi-agent solutions across DTAP environments and needs a production cutover strategy that can reverse a bad agent package within minutes if health probes fail. Which approach best meets that requirement?
• A platform team wants every multi-agent change—prompt files, tool schemas, orchestration graphs, and Azure infrastructure—to follow the same quality bar before production. Which CI/CD requirement set best fits AI-500 deployment guidance?
• A multi-agent system in Azure must call internal finance APIs that must not be reachable from the public internet. Agents run in Foundry-connected compute inside a virtual network. Which network design best enforces this boundary?
• An architect reviews RBAC for a multi-agent solution. The research agent only needs read access to a knowledge index and a web-fetch tool. The fulfillment agent needs to create support tickets. Currently both agents use a role that can read secrets, write tickets, and delete indexes. What change best applies least privilege?
• A regulated multi-agent assistant can read user input, call internal tools, receive tool responses, and produce user-facing answers. Security review found filtering only on the final answer, allowing jailbreak text in inputs and sensitive data in tool responses to influence intermediate reasoning and tool selection. Which guardrail strategy best addresses the gap?
• A financial-services team is deploying a multi-agent solution in Microsoft Foundry. A research agent must read SharePoint knowledge bases, while a settlement agent must call a payment API. Security requires that a compromise of the research agent must not allow access to payment credentials. Which design best enforces this Zero Trust boundary?
• An orchestrator agent in Microsoft Foundry accepts an end-user chat session and must call a downstream specialist agent that then invokes Microsoft Graph using the signed-in user’s permissions. The specialist must never use application-only permissions for mailbox data. Which authentication flow should you implement between the user, orchestrator, and specialist tools?
• A healthcare multi-agent system must block PHI leakage, unsafe tool use, and non-compliant model outputs. Architects want defense-in-depth rather than a single filter at the end of the chat. Which guardrail strategy best matches multi-intervention design for multi-agent solutions?
• Your multi-agent solution stores third-party API keys in Azure Key Vault. Agents currently fail for up to an hour after secrets rotate because they cache values at process start. Operations needs rotation without multi-hour outages and without putting secrets in source control. What should you implement?
• Before promoting a multi-agent Foundry solution from test to production, the security team wants automated adversarial probing of prompts, tool misuse, and jailbreaks as part of CI—not only annual pen tests. Which approach best applies shift-left security for this solution?
• A platform team must release a new orchestrator prompt and tool graph for a customer-facing multi-agent app with minimal blast radius. They need progressive exposure, quick rollback if quality or safety metrics regress, and no big-bang cutover. Which release approach fits best?
• A regulated enterprise requires that multi-agent workloads in Azure cannot reach the public internet for tool APIs hosted on Azure App Service and Azure OpenAI. Agents still need private connectivity to those endpoints and to Key Vault. Which network design best meets the requirement?
• A banking multi-agent assistant must never recommend specific securities trades or promise guaranteed returns, even if users jailbreak the base model safety filters. Compliance wants automated proof that custom policies hold. What should you implement?
• A team maintains multi-agent definitions, tool registrations, prompt assets, and Azure infrastructure for Microsoft Foundry. They need repeatable promotions across Development, Test, Acceptance, and Production with auditability. Which approach best satisfies CI/CD and multi-environment requirements?
• In a multi-agent system, any specialist can currently invoke any registered tool, including high-risk actions such as wire transfers and customer data export. You must enforce authorization checks consistently without rewriting every agent prompt. What is the best design?
• A multi-agent system previously used one shared service principal with broad access to Key Vault, SQL, and Storage for every agent. Security mandates Zero Trust with lateral movement prevention. What identity design should you implement?
• An agent must read the signed-in user’s calendar and create events only as that user—not as a shared daemon with access to every mailbox. Which authentication approach is appropriate?
• MCP tool connectors need API keys and certificates. Developers currently paste secrets into container environment variables at build time and rebuild to rotate. What secrets-management approach should you design for multi-agent Azure deployments?
• Security wants shift-left testing of a multi-agent Foundry solution for jailbreaks, tool abuse, and data exfiltration attempts before external launch. Which capability should you incorporate into the SDLC?
• A regulated multi-agent assistant must block toxic user inputs, prevent disallowed tool calls, validate tool responses before they re-enter reasoning, and filter final answers for policy violations. What guardrail strategy matches this requirement?
• A healthcare multi-agent triage helper must never recommend specific prescription dosages, even if a model would. Built-in generic safety filters are not domain-specific enough. What should you implement?
• You are releasing a new orchestrator prompt and tool schema for a production multi-agent concierge. Risk of quality regression is moderate; you need limited real traffic exposure with fast rollback. Which release methodology fits best?
• Enterprise policy requires multi-agent solutions to move through Development, Test, Acceptance, and Production with infrastructure-as-code and a documented rollback. Which design meets this?
• Your pipeline deploys multi-agent code to Azure but only runs unit tests on pure Python helpers. Several regressions shipped because tool wiring and prompt changes were untested. What CI/CD requirement should you add?
• A multi-agent solution in Azure calls internal knowledge indexes and MCP tools hosted on private APIs. Compliance forbids agent traffic to those backends over the public internet. Which control should you specify?
• After a canary showed elevated tool-error rates, you need an immediate switch back to the last known-good multi-agent graph and model deployment with minimal DNS-level complexity. Environments already run side by side. Which approach is most appropriate?