During red-team testing, a Foundry-hosted chatbot aimed at teenage users produces one toxic reply even though Azure AI Content Safety filtering is already enabled on the deployment. The team wants to add further layers of defense on top of the existing filter rather than replace it. (Select TWO.)
Select all correct answers, then click Submit.
Short Explanation
One toxic reply getting through even with the filter on means it is time to stack a second and third layer of defense rather than lean harder on the one that already let something slip. Telling the model itself, in plain language in its instructions, exactly what lines it must never cross gives you a layer that acts before generation even happens. And tightening how strict the existing filter is - so it catches more of the borderline stuff instead of only the obviously severe stuff - gives you a second layer that acts after generation, as a backstop. Neither one replaces the other; together they cover more ground. Cranking up the randomness setting pulls in the opposite direction - more variation in output tends to make behavior less predictable, not safer. And cutting off the record of conversations does not make future replies any safer at all - it just means nobody can go back and see what happened next time something slips through.
Full Explanation
The correct answers are B and D. Adding explicit behavioral boundaries and refusal instructions to the system message gives the model an additional, model-level layer of guidance about what it should never say, which works alongside rather than instead of the independent content safety filter. Lowering the filter's severity threshold makes the existing filter stricter, catching more borderline harmful content before it reaches the user, which directly reduces the chance of another toxic reply slipping through. Together these add a prompt-level safeguard and a stricter filter-level safeguard, a genuine layered defense. Option C is incorrect because increasing temperature makes output more varied and less predictable, which works against consistent safety behavior and could make toxic replies more likely rather than less. Option A is incorrect because disabling logging removes the team's ability to review what the model actually said during incidents like this one, undermining their ability to detect and diagnose future safety failures rather than preventing them; it addresses data retention cost, not response safety. Layering a tightened content filter with clearer in-prompt behavioral limits addresses the failure from two independent angles, which is more robust than adjusting either alone.