Practice question 497 of 498 · hard
An AI agent pilot gains a new external-content connector and a private data source in a governed landing zone. The prior evaluation covered only fixed internal documents. Which TWO validations directly address the newly introduced security boundaries? Select TWO.
Select all that apply. Every correct option and no extras are required for credit in the app.
Show the answer and explanation
✓ Correct answers
- Test indirect prompt injection from the external connector and verify independent downstream authorization
- Validate approved data scope, identity permissions, and sensitive-data handling for the new source
Test indirect prompt injection from the external connector and verify independent downstream authorization: New untrusted content can manipulate behavior, so authorization must remain enforced. Validate approved data scope, identity permissions, and sensitive-data handling for the new source: Private connectivity and platform guardrails do not automatically set the correct data entitlements. Reuse the fixed-document evaluation without testing the new connector: The new content path was outside the prior evaluation. Assume a landing-zone deployment automatically certifies every model and connector: It provides a foundation rather than complete AI assurance. Make the agent platform Owner so private endpoints cannot cause access errors: This broadens authority without validating the needed data boundary. Let the connector publish secrets into prompts for more reliable authentication: Prompts are not appropriate credential stores.
Read and review here, or open the app to practise and save your results on this device.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.