A is correct: Audit (Premium) supports custom audit log retention policies. However, retention beyond one year requires the 10-year audit log retention add-on license per user. With this add-on, organizations can configure retention for 3, 5, 7, or 10 years to meet regulatory requirements. Reference: https://learn.microsoft.com/en-us/purview/audit-log-retention-policies

B is incorrect: Manual CSV exports are error-prone, difficult to search, and do not provide the integrity, tamper-resistance, or searchability required for regulatory compliance. Microsoft Purview audit retention policies provide a managed, compliant solution. Reference: https://learn.microsoft.com/en-us/purview/audit-log-retention-policies

C is incorrect: Audit (Premium) included with E5 retains Exchange, SharePoint, OneDrive, and Entra ID audit records for one year by default and 180 days for other activities. Seven-year retention requires the 10-year audit log retention add-on license. Reference: https://learn.microsoft.com/en-us/purview/audit-premium

D is incorrect: Audit (Standard) retains audit logs for only 180 days by default, not seven years. It does not support custom retention policies or extended retention periods required for long-term regulatory compliance in financial services. Reference: https://learn.microsoft.com/en-us/purview/audit-solutions-overview

A is incorrect: EDiscovery is a reactive investigation tool for legal and compliance searches, not a proactive data protection control. It cannot prevent sensitive data exposure in real time. DSPM for AI with DLP policies provides proactive prevention. Reference: https://learn.microsoft.com/en-us/purview/ai-microsoft-purview

B is correct: DSPM for AI provides centralized visibility into AI data risks and enables one-click policies including DLP protection for sensitive data in prompts and responses. Sensitivity labels add an additional protection layer ensuring AI apps respect data access restrictions. Reference: https://learn.microsoft.com/en-us/purview/dspm-for-ai

C is incorrect: Communication Compliance detects regulatory and conduct violations in communications but is designed for detecting inappropriate messaging, not comprehensively preventing sensitive data exposure. DSPM for AI provides broader protection. Reference: https://learn.microsoft.com/en-us/purview/ai-microsoft-purview

D is incorrect: Retention and deletion policies manage data lifecycle but do not prevent sensitive data from being accessed or shared during AI interactions. Deleting logs removes audit evidence without addressing the underlying data protection need. Reference: https://learn.microsoft.com/en-us/purview/dspm-for-ai-considerations

A is incorrect: Azure AI Foundry models do not use the same content moderation controls as managed models in the prompt builder. The slider is specifically disabled for these externally hosted models because the content moderation policies must be managed at the Azure AI Foundry level rather than within Copilot Studio. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/prompt-model-settings

B is correct: The Content moderation level setting is available only for managed models provided by Copilot Studio. When you select an Azure AI Foundry model or Anthropic model, the moderation slider becomes unavailable because these models are managed outside Copilot Studio's built-in moderation framework. Organizations should apply Responsible AI policies for these models directly in Azure AI Foundry instead. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/prompt-model-settings

C is incorrect: While DLP policies in the Power Platform admin center can govern the Azure AI Foundry connector, DLP policies control data flow between connectors rather than content moderation levels for harmful output. Content moderation for these models should be managed using Responsible AI policies in Azure AI Foundry. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/prompt-model-settings

D is incorrect: Azure AI Foundry models do not automatically inherit the agent-level content moderation settings. The content moderation slider is unavailable for these models in the prompt builder, and moderation must be managed within Azure AI Foundry using its own Responsible AI policy configuration. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/prompt-model-settings

A is incorrect: Placing AI resources directly under the platform management group for policy inheritance is not recommended. Governance policies should instead derive from their specific workload management groups to prevent development bottlenecks and enable operational autonomy for workload teams.

B is correct: The Cloud Adoption Framework advises segregating management groups for AI applications based on their internet exposure, distinguishing between external-facing (online) and internal-only (corporate) systems. This approach establishes crucial data governance perimeters, ensuring sensitive internal data remains protected from external access while maintaining appropriate control.

C is incorrect: Consolidating all AI workloads into a single management group would prevent the creation of necessary data governance boundaries between external and internal applications. This lack of separation could lead to sensitive internal business data becoming accessible to external users due to improperly inherited access controls.

D is incorrect: Management group structures should primarily reflect data governance requirements and workload exposure patterns rather than the specific AI model types in use. The Cloud Adoption Framework emphasizes differentiation by internet-facing versus internal access to safeguard confidential data effectively.

A is correct: Generative orchestration recognizes multiple intents in a single utterance, automatically chains actions and knowledge sources, and generates unified responses. It dynamically creates execution plans by reasoning over available topic and action descriptions. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/guidance/language-understanding

B is incorrect: While CLU provides advanced entity extraction capabilities, it maps to individual Copilot Studio topics through intent matching. CLU does not provide the dynamic plan generation or automatic chaining of multiple topics and actions that generative orchestration offers. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-clu-integration

C is incorrect: Classic orchestration triggers only one topic per user utterance based on trigger phrase matching. It cannot recognize multiple intents in a single message or automatically chain multiple topics together to handle compound requests. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-generative-actions

D is incorrect: Building one topic for every possible intent combination is impractical and unmaintainable at scale. It violates modular design principles and cannot dynamically adapt to new combinations without manual authoring of every conversational path. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/guidance/topic-authoring-best-practices

A is incorrect: Retention policies automatically clean up old package versions based on age and version count, not validation status. They are designed for storage management, not quality gating. Packages promoted to a view are actually exempt from retention policies. Reference: https://learn.microsoft.com/en-us/azure/devops/artifacts/concepts/best-practices

B is incorrect: Organization-scoped feeds cannot be converted to project-scoped feeds and only project-scoped feeds in public projects can be made public. Additionally, making feeds public would expose packages beyond the organization, violating the requirement to restrict in-development packages. Reference: https://learn.microsoft.com/en-us/azure/devops/artifacts/concepts/feeds

C is incorrect: Creating separate organizations adds unnecessary administrative overhead and makes cross-environment sharing more complex. Azure Artifacts feed views within a single organization provide quality gating without the complexity of managing multiple organizations. Reference: https://learn.microsoft.com/en-us/azure/devops/artifacts/concepts/best-practices

D is correct: Feed views allow you to share only packages that have been tested and validated while holding back packages still under development. Promoting packages to the @Release view makes them available to consumers while keeping in-development packages restricted to the @Local view. Reference: https://learn.microsoft.com/en-us/azure/devops/artifacts/concepts/views

A is incorrect: The system fallback topic does not immediately escalate. By default it first re-engages the user by asking them to rephrase their question up to two additional times before redirecting to the Escalate system topic for live agent handoff. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-system-fallback-topic

B is incorrect: Searching knowledge sources to generate a response describes the Conversational boosting system topic, which triggers before the fallback topic in processing priority. The fallback topic itself handles cases where both topic matching and conversational boosting have already failed. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/guidance/fallback-topic

C is correct: The system fallback topic triggers on unrecognized intent and includes a condition to ask the user to rephrase no more than twice. If the agent still cannot determine intent after two retries, the conversation is redirected to the Escalate system topic for handoff to a live representative. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-system-fallback-topic

D is incorrect: The system fallback topic does not close conversations or create case records by default. Its default behavior is to prompt the user to rephrase and then redirect to the Escalate system topic, which can then be customized to include additional handoff logic. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-system-fallback-topic

A is incorrect: Granting unrestricted administrative access violates the principle of least privilege and creates significant security risk. If an agent produces incorrect or adversarially manipulated function calls, full access amplifies the potential blast radius across all connected enterprise systems. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/function-calling

B is incorrect: Disabling validation exposes the system to risks from model hallucinations where incorrect function arguments may be generated. Downstream error handling alone cannot prevent unauthorized data access or incorrect write operations that have already been executed against systems. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/function-calling

C is incorrect: Azure OpenAI guidelines recommend using only data from trusted and verified sources. Untrusted data in function outputs could instruct the model to generate function calls in unintended ways, creating prompt injection vulnerabilities and compromising data integrity. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/function-calling

D is correct: Azure OpenAI documentation recommends always validating the function calls generated by the model and following the principle of least privilege, granting only the minimum access necessary. This limits potential impact if an agent produces incorrect or manipulated function calls. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/function-calling

A is incorrect: TSV format does not support complex nested structures. Splitting list elements into separate columns changes the flow input schema and does not match the expected list structure. JSONL is required for complex inputs. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/flow-bulk-test-evaluation

B is correct: In Prompt Flow, if flow inputs include complex structures like lists or dictionaries, you must use JSONL format to represent your data. While CSV and TSV are supported for simple inputs, they cannot natively represent nested data structures. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/flow-bulk-test-evaluation

C is incorrect: Prompt Flow does not automatically convert complex structures from flat formats like CSV or TSV. The documentation explicitly states that JSONL format should be used when flow inputs include complex structures. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/flow-bulk-test-evaluation

D is incorrect: CSV format does not natively support complex data structures. Prompt Flow documentation specifies that JSONL should be used when flow inputs include complex structures like lists or dictionaries to preserve proper data types. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/flow-bulk-test-evaluation