A is correct: The flow.dag.yaml file is the primary flow definition file integral to authoring and defining prompt flow. It defines nodes, tools, connections, and environment settings. Combined with referenced source files, it enables complete flow versioning in code repositories. Reference: https://learn.microsoft.com/en-us/azure/machine-learning/prompt-flow/how-to-integrate-with-llm-app-devops

B is incorrect: Compute session settings are infrastructure-level configurations managed in the Foundry portal, not primary artifacts for flow versioning. The flow.dag.yaml file captures the flow definition that must be version-controlled to track prompt and logic changes. Reference: https://learn.microsoft.com/en-us/azure/machine-learning/prompt-flow/how-to-integrate-with-llm-app-devops

C is incorrect: While requirements.txt is part of the flow folder and important for environment reproducibility, it only defines package dependencies. The flow.dag.yaml file is the primary definition that captures the complete flow logic and structure needed for version control. Reference: https://learn.microsoft.com/en-us/azure/machine-learning/prompt-flow/how-to-integrate-with-llm-app-devops

D is incorrect: Connection strings are secrets that should never be committed to source control. Connections in prompt flow are managed separately through the portal or REST API. The flow.dag.yaml references connections by name without embedding credentials. Reference: https://learn.microsoft.com/en-us/azure/machine-learning/prompt-flow/how-to-integrate-with-llm-app-devops

A is incorrect: The Failures view focuses on error rates, failed requests, and exception types. While failures may correlate with degraded performance, investigating latency spikes should begin with the Performance view dependency duration analysis, not error counts. Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/app/failures-performance-transactions

B is correct: The Performance view Dependencies tab lets you select individual dependencies and view a distribution of their durations. Each request event is associated with its dependency calls, enabling you to find out whether slow responses from a specific dependency are causing the agent latency issue. Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/app/dependencies

C is incorrect: The Availability view configures synthetic monitoring tests to proactively verify endpoint responsiveness from various geographic locations. It does not analyze real-time dependency latency patterns within live agent execution paths. Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview

D is incorrect: SDK Stats shows instrumentation pipeline health such as exporter success, dropped counts, and retry rates. These metrics indicate whether telemetry is being reliably transmitted, not whether a specific downstream dependency is causing agent response latency. Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview

A is incorrect: This is the default behavior for post-deployment conditions, not pre-deployment conditions. For post-deployment, gates are evaluated first and approvals are prompted only when all gates succeed, ensuring approvers have all the information. Pre-deployment conditions default to approvals first. Reference: https://learn.microsoft.com/en-us/azure/devops/pipelines/release/approvals/gates

B is incorrect: Approvals and gates are not evaluated simultaneously by default. Azure DevOps evaluates them sequentially in a defined order. For pre-deployment conditions, approvals are prompted first, and gate evaluation begins only after approval is granted. The sequential approach is intentional for efficiency. Reference: https://learn.microsoft.com/en-us/azure/devops/pipelines/release/approvals/

C is incorrect: Gates do not run on a continuous loop independently of approvals. Azure DevOps evaluates pre-deployment approvals and gates in a configured sequence, defaulting to approvals first. Gates are evaluated at defined sampling intervals only after the approval phase completes. Reference: https://learn.microsoft.com/en-us/azure/devops/pipelines/release/approvals/gates

D is correct: For pre-deployment conditions, the default order prompts for manual approvals first, then evaluates gates afterward. This saves the system from evaluating the gate functions if the release is rejected by the user. This ordering is configurable, but the default behavior optimizes for efficiency by avoiding unnecessary gate evaluation. Reference: https://learn.microsoft.com/en-us/azure/devops/pipelines/release/approvals/gates

A is incorrect: Shared service accounts lack the granular identity management and adaptive access controls that Microsoft Entra Agent ID provides. Agent ID introduces purpose-built first-class identity constructs specifically designed for AI agents, not repurposed user accounts, which cannot leverage agent-specific risk signals. Reference: https://learn.microsoft.com/en-us/entra/agent-id/identity-professional/microsoft-entra-agent-identities-for-ai-agents

B is incorrect: Assigning Global Administrator to agents violates the principle of least privilege and creates significant security risk. Agents should receive only the minimum permissions necessary for their specific tasks, managed through purpose-built Agent ID constructs and Conditional Access policies. Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices

C is correct: Microsoft Entra Agent ID extends Conditional Access evaluation and enforcement to AI agents. It treats agents as first-class identities and evaluates their access requests the same way it evaluates requests for human users, but with agent-specific logic. This ensures Zero Trust principles are consistently applied to both human and agent identities. Reference: https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-id

D is incorrect: API key-based authentication bypasses Azure RBAC and Conditional Access entirely, providing no adaptive access controls or risk-based evaluation. Microsoft recommends using Entra ID authentication for improved security and granular access control over agents. Reference: https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/rbac-foundry

A is incorrect: LLMs should not construct raw API queries because they may produce incorrect syntax, expose sensitive parameters, or create injection vulnerabilities. Semantic Kernel plugins encapsulate API interactions with proper authentication callbacks and error handling. Reference: https://learn.microsoft.com/en-us/semantic-kernel/concepts/plugins/

B is correct: Semantic Kernel text search provides a high-level abstraction for data retrieval that can be exposed as a plugin to chat completion. The plugin retrieves relevant documents at query time and inserts results into the prompt template before the LLM processes the request, enabling effective RAG. Reference: https://learn.microsoft.com/en-us/semantic-kernel/concepts/text-search/

C is incorrect: Preloading all documents exceeds LLM token limits, introduces stale data, and wastes resources on irrelevant content. RAG patterns retrieve only relevant data at query time, which is exactly what text search plugins with function calling are designed to accomplish. Reference: https://learn.microsoft.com/en-us/semantic-kernel/concepts/text-search/

D is incorrect: A standalone service with webhook callbacks adds latency and architectural complexity by operating outside the Semantic Kernel pipeline. The plugin architecture provides built-in integration for injecting search results directly into prompt rendering and function calling flows. Reference: https://learn.microsoft.com/en-us/semantic-kernel/concepts/plugins/

A is incorrect: Computer Use runs on managed infrastructure through hosted browsers, Cloud PC pools, or BYO machines. No dedicated AKS cluster provisioning is required because the CUA model execution is handled by the Copilot Studio platform infrastructure. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/configure-where-computer-use-runs

B is incorrect: Topics do not need to be migrated to Power Automate scheduled triggers. When generative orchestration is enabled, existing topics are preserved and Copilot Studio automatically generates descriptions from existing trigger phrases for the orchestrator. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-generative-actions

C is incorrect: Existing connectors and agent flows do not conflict with Computer Use. Computer Use is added as an additional tool alongside existing tools. The generative orchestrator can select the appropriate tool based on the user query context. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/add-tools-custom-agent

D is correct: Computer Use requires the generative orchestrator to be enabled on the agent. Classic orchestration does not support Computer Use as a tool. The architect must switch the agent to generative orchestration before adding Computer Use. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/computer-use

A is incorrect: Copilot connectors index data into Microsoft Graph for knowledge retrieval and serve a different purpose than action-based custom connectors. They do not bypass payload limits, and they are not a direct replacement for custom connectors that perform operations. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-copilot-connectors

B is correct: The AsyncResponsePayloadTooLarge error occurs when a connector returns a payload larger than the agent can handle. The recommended approach is to apply available connector filters and limit the number of configured action outputs to reduce the overall size of the response to stay within the connector payload limit. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-quotas

C is incorrect: The connector payload limit is a platform constraint that applies across Copilot Studio plans. While default quotas can be adjusted on a case-by-case basis, the solution requires reducing the response size through filtering rather than expecting a license upgrade to remove limits. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-quotas

D is incorrect: While Dataverse can be a data source, migrating an entire external product catalog is disproportionate to the problem. The appropriate solution is to reduce the connector response payload through filtering and limiting outputs at the API query level. Reference: https://learn.microsoft.com/en-us/troubleshoot/power-platform/copilot-studio/authoring/error-codes

A is incorrect: Azure Event Hubs is a streaming platform for event ingestion, not the mechanism for connecting Copilot Studio to Application Insights. The connection requires the Application Insights connection string configured directly in the agent's Advanced settings. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-bot-framework-composer-capture-telemetry

B is correct: To connect a Copilot Studio agent to Application Insights, you populate the connection string setting in the Application Insights section of the agent's Advanced settings page. Once configured, telemetry data including messages, events, and custom dimensions is automatically logged during user interactions. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-bot-framework-composer-capture-telemetry

C is incorrect: Azure Storage Accounts are not used to connect Copilot Studio agents to Application Insights. The telemetry pipeline requires the Application Insights connection string populated in the agent's Advanced settings, not a storage account connection. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-bot-framework-composer-capture-telemetry

D is incorrect: While Application Insights uses Log Analytics as its backend data store, you do not configure a workspace ID directly. The connection is established through the Application Insights connection string in the agent's Advanced settings within Copilot Studio. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-bot-framework-composer-capture-telemetry

A is incorrect: Copilot Studio does not automatically generate case records during handoff. It shares the full conversation transcript and all collected variables. The representative who receives the escalation sees the complete agent conversation transcript and can use that context for case creation. Reference: https://learn.microsoft.com/en-us/dynamics365/customer-service/administer/configure-bot-virtual-agent

B is incorrect: All conversation history and relevant variables are shared during handoff automatically. Additionally, the Transfer conversation node supports a private message to the live agent stored in the va_AgentMessage context variable for supplementary context about the escalation reason. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-hand-off

C is incorrect: Copilot Studio shares significantly more than just the last message and topic name. The full conversation transcript and all collected variable values are transferred to the engagement hub, enabling the live agent to understand the entire conversation context from beginning to end. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-hand-off

D is correct: When Copilot Studio hands off a conversation to Dynamics 365 Customer Service, it shares the full history of the conversation and all variables collected during the interaction. This enables the live agent to see the complete prior context and seamlessly resume the conversation without requiring the customer to repeat information. Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/configuration-hand-off-omnichannel

A is correct: Azure RBAC is the recommended authorization model for Key Vault and integrates with Privileged Identity Management for time-limited, just-in-time access to privileged roles. This ensures administrators only have elevated access during approved time windows. Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy

B is incorrect: Key Vault firewall rules control network access based on IP addresses, not identity-based time-limited access. Firewall rules do not integrate with PIM and cannot provide just-in-time privileged role activation for Key Vault administrators. Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/secure-key-vault

C is incorrect: The legacy vault access policy model does not support integration with Privileged Identity Management or time-limited access assignments. Access policies grant persistent permissions without built-in mechanisms for just-in-time elevation. Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy

D is incorrect: Shared access keys are not a Key Vault authorization model. Key Vault uses identity-based authentication through Microsoft Entra ID, and the RBAC permission model provides the PIM integration required for just-in-time access. Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/authentication