10 AI-103 Practice Questions: Scenario-Based Exam Prep for 2026

Why B is correct:

Hallucination prevention for structured, real-time data requires grounding in a live data source via function calling, not vector search. Azure AI Search indexes snapshots. It cannot guarantee account balance accuracy at query time. Function calling gives the agent a deterministic path: model identifies intent, calls tool, tool queries SQL, returns verified data, model formats response.

Why C (the trap) is wrong:

RAG with AI Search works for document grounding like PDFs and policies. But for real-time transactional data, indexed content is stale by definition.

Why D is correct:

Prompt Shield detects and blocks jailbreak attempts and indirect prompt injection, which is exactly what "prompted cleverly" describes. The QA team is finding adversarial prompts, not random model drift. Prompt Shield intercepts these before they reach the model.

Why A (the most common wrong answer) is wrong:

System prompt instructions are bypass-able. The scenario already tells you the QA team bypassed normal behaviour when prompted cleverly. This is precisely the jailbreak pattern Prompt Shield addresses.

Why D is correct:

The Semantic Kernel Process Framework is purpose-built for structured multi-step workflows where steps must be individually testable, reusable, and event-driven. Unlike the Planner (which uses AI to decide step order at runtime), Process Framework gives deterministic control. This is critical when you have compliance steps like logging to Azure Monitor.

Why B (the subtle trap) is wrong:

The Planner is non-deterministic. It uses the AI model to decide which plugins to call and in what order. You cannot guarantee it will always call the logging step on every run.

Why D is correct:

Two constraints decide this: cost minimisation and predictable latency at scale. GPT-4o Mini handles intent classification at a fraction of the cost with no capability gap for this use case. PTU provides reserved, consistent throughput, making sub-800ms latency predictable at 4M calls/month, not aspirational.

Why A (the expensive trap) is wrong:

GPT-4o is significantly more expensive per token than GPT-4o Mini with zero benefit for this use case. Standard deployment at this volume will also encounter throttling.

Why B is correct:

Each requirement maps directly. Source citation: AI Search returns document metadata including chunk location. Complex questions: hybrid search outperforms keyword or vector alone. 15-min indexing SLA: indexer with change detection policy runs every 5 minutes minimum. Azure-native + AI Foundry integration: Azure AI Search is the native retrieval backbone for AI Foundry agents.

Why D (the subtle trap) is wrong:

Semantic ranking re-ranks results, it does not retrieve them. Semantic ranking alone without keyword or vector search is not a complete retrieval strategy and will underperform on complex legal language.

Why B is correct:

Groundedness Detection evaluates whether model outputs are factually supported by a provided source document. You pass the original article as the grounding source and the generated summary as the target. The service flags any claims not supported by the article automatically. This is the only option that directly addresses factual grounding in output.

Why A (the common misdirection) is wrong:

Prompt Shield protects against jailbreaks and indirect prompt injection on the input side. It does nothing to evaluate whether model output is grounded in source material. The threat here is hallucination in output, not adversarial input.

Why B is correct:

Azure AI Foundry Agent threads persist the full conversation history and structured context across multiple agent interactions. When the claims intake agent completes, the thread is passed to the policy validation agent with full context intact. This is the native Azure AI Foundry pattern for multi-agent handoffs.

Why C (the over-engineered trap) is wrong:

Azure Service Bus works technically but introduces unnecessary infrastructure complexity for a use case that Azure AI Foundry threads handle natively. On the exam, always prefer the native service capability over a custom-built alternative when one exists.

Why B is correct:

Semantic Kernel Memory with a vector store backend enables semantic retrieval of facts from previous sessions. The jurisdiction fact is stored as an embedding in Azure AI Search. When session 3 starts, the assistant semantically queries memory for relevant user context and retrieves it automatically, without requiring the user to repeat themselves.

Why D (the plausible trap) is wrong:

Conversation summarisation works but degrades over time as summaries compound and lose precision. It also requires the developer to decide what to summarise, which introduces selective memory errors. Semantic Memory retrieves based on relevance at query time, which is more robust for long-term fact retention.

Why C is correct:

This query involves multiple compound constraints (drug X + drug Y + age cohort + comorbidity). Hybrid search casts the widest net across both keyword and semantic dimensions, and the semantic ranking L2 reranker re-scores the top candidates for contextual relevance, giving the highest precision for complex multi-part clinical queries. The budget note signals that semantic ranking (Standard tier or above) is within scope.

Why B (the modern but incomplete trap) is wrong:

Pure vector search excels at semantic similarity but can miss exact drug name matches that keyword search catches reliably. In pharmaceutical contexts, exact term matching for drug names is critical and vector search alone is insufficient.

Why B and C are correct:

Two requirements are critically unmet in the proposal. Requirement 4 (consistent latency at 10,000 queries/day): GPT-4o Standard shares capacity and will throttle at this volume. PTU provides reserved throughput and predictable latency. This is a direct architectural failure at scale. Requirement 2 (block prompt manipulation): A system prompt warning is bypassed by jailbreak attempts by design. Prompt Shield is the correct control for detecting and blocking adversarial inputs before they reach the model.

Why E and D (tempting but not most critical) are wrong:

Groundedness Detection would strengthen requirement 1 but the existing AI Search + RAG architecture partially addresses grounding already. The two critical failures are scale and security. On the exam, "most critical" targets requirements that completely fail, not those partially met. Azure Monitor is the correct Azure-native audit logging service. Replacing it with Cosmos DB adds unnecessary complexity and is not an improvement.