Exam Bundle

A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure. Such evidence would validate a different change: A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. It follows the separate remedy Treat retrieved document text as untrusted data and restrict tools, secrets and prompt-following privileges at the execution boundary. The Brookside Manufacturing scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

A failing agent trace identifies the specific tool and error without storing sensitive prompt contents. Such evidence would validate a different change: A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. It follows the separate remedy Capture sanitized tool-call traces, correlation IDs, latency and exception categories in approved monitoring. The Brookside Manufacturing scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Responses summarize permitted interactions and excluded confidential records never appear in tool results. Such evidence would validate a different change: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. It follows the separate remedy Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. The Brookside Manufacturing scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Require a human confirmation checkpoint and deterministic amount verification before authorizing any payment write. This is a plausible technique for a DIFFERENT requirement: A generative agent automatically approves vendor payments based on free-form text without human approval. The Silvercrest University failure described here instead concerns A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. That choice does not establish the required correction; the acceptance result must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Choose an integration architecture connecting the Foundry agent and Copilot Studio agent with explicit responsibilities and boundaries. This is a plausible technique for a DIFFERENT requirement: A support assistant is built as a generic Foundry agent although its workflows are tightly integrated with Copilot Studio conversations. The Silvercrest University failure described here instead concerns A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. That choice does not establish the required correction; the acceptance result must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Capture sanitized tool-call traces, correlation IDs, latency and exception categories in approved monitoring. This is a plausible technique for a DIFFERENT requirement: A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. The Silvercrest University failure described here instead concerns A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. That choice does not establish the required correction; the acceptance result must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

A failing agent trace identifies the specific tool and error without storing sensitive prompt contents. Such evidence would validate a different change: A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. It follows the separate remedy Capture sanitized tool-call traces, correlation IDs, latency and exception categories in approved monitoring. The Silvercrest University scenario instead reports A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The decisive observation must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call. Such evidence would validate a different change: A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. It follows the separate remedy Enforce least-privilege authorization at the MCP tool boundary and restrict destructive operations to appropriate identities. The Silvercrest University scenario instead reports A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The decisive observation must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Responses summarize permitted interactions and excluded confidential records never appear in tool results. Such evidence would validate a different change: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. It follows the separate remedy Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. The Silvercrest University scenario instead reports A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The decisive observation must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Create a representative evaluation dataset with accuracy, tool-use, access-control and refusal tests plus release thresholds. This is a plausible technique for a DIFFERENT requirement: An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The Highland Education failure described here instead concerns A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. That choice does not establish the required correction; the acceptance result must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Use the supported Copilot Studio client library and its documented authentication/session methods. This is a plausible technique for a DIFFERENT requirement: A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The Highland Education failure described here instead concerns A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. That choice does not establish the required correction; the acceptance result must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Expose narrowly scoped Microsoft Power Platform MCP server tools with authenticated authorization per operation. This is a plausible technique for a DIFFERENT requirement: A custom Foundry agent must query customer cases through enterprise tools but its developer gives it broad direct database access. The Highland Education failure described here instead concerns A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. That choice does not establish the required correction; the acceptance result must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping. Such evidence would validate a different change: A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. It follows the separate remedy Use the supported Copilot Studio client library and its documented authentication/session methods. The Highland Education scenario instead reports A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The decisive observation must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Responses summarize permitted interactions and excluded confidential records never appear in tool results. Such evidence would validate a different change: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. It follows the separate remedy Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. The Highland Education scenario instead reports A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The decisive observation must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

In tests the agent proposes an action but no payment executes until a permitted approver confirms it. Such evidence would validate a different change: A generative agent automatically approves vendor payments based on free-form text without human approval. It follows the separate remedy Require a human confirmation checkpoint and deterministic amount verification before authorizing any payment write. The Highland Education scenario instead reports A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The decisive observation must be: A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure.

Choose an integration architecture connecting the Foundry agent and Copilot Studio agent with explicit responsibilities and boundaries. This is a plausible technique for a DIFFERENT requirement: A support assistant is built as a generic Foundry agent although its workflows are tightly integrated with Copilot Studio conversations. The Harborline Logistics failure described here instead concerns An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. That choice does not establish the required correction; the acceptance result must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

Treat retrieved document text as untrusted data and restrict tools, secrets and prompt-following privileges at the execution boundary. This is a plausible technique for a DIFFERENT requirement: A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The Harborline Logistics failure described here instead concerns An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. That choice does not establish the required correction; the acceptance result must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

Capture sanitized tool-call traces, correlation IDs, latency and exception categories in approved monitoring. This is a plausible technique for a DIFFERENT requirement: A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. The Harborline Logistics failure described here instead concerns An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. That choice does not establish the required correction; the acceptance result must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping. Such evidence would validate a different change: A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. It follows the separate remedy Use the supported Copilot Studio client library and its documented authentication/session methods. The Harborline Logistics scenario instead reports An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The decisive observation must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure. Such evidence would validate a different change: A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. It follows the separate remedy Treat retrieved document text as untrusted data and restrict tools, secrets and prompt-following privileges at the execution boundary. The Harborline Logistics scenario instead reports An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The decisive observation must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

A failing agent trace identifies the specific tool and error without storing sensitive prompt contents. Such evidence would validate a different change: A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. It follows the separate remedy Capture sanitized tool-call traces, correlation IDs, latency and exception categories in approved monitoring. The Harborline Logistics scenario instead reports An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The decisive observation must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

Enforce least-privilege authorization at the MCP tool boundary and restrict destructive operations to appropriate identities. This is a plausible technique for a DIFFERENT requirement: A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. The Maplewood Schools failure described here instead concerns An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. That choice does not establish the required correction; the acceptance result must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

Require a human confirmation checkpoint and deterministic amount verification before authorizing any payment write. This is a plausible technique for a DIFFERENT requirement: A generative agent automatically approves vendor payments based on free-form text without human approval. The Maplewood Schools failure described here instead concerns An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. That choice does not establish the required correction; the acceptance result must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. This is a plausible technique for a DIFFERENT requirement: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. The Maplewood Schools failure described here instead concerns An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. That choice does not establish the required correction; the acceptance result must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping. Such evidence would validate a different change: A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. It follows the separate remedy Use the supported Copilot Studio client library and its documented authentication/session methods. The Maplewood Schools scenario instead reports An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The decisive observation must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

In tests the agent proposes an action but no payment executes until a permitted approver confirms it. Such evidence would validate a different change: A generative agent automatically approves vendor payments based on free-form text without human approval. It follows the separate remedy Require a human confirmation checkpoint and deterministic amount verification before authorizing any payment write. The Maplewood Schools scenario instead reports An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The decisive observation must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

Responses summarize permitted interactions and excluded confidential records never appear in tool results. Such evidence would validate a different change: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. It follows the separate remedy Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. The Maplewood Schools scenario instead reports An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The decisive observation must be: Regression runs expose failures before deployment and version-to-version quality changes are measurable.

Use the supported Copilot Studio client library and its documented authentication/session methods. This is a plausible technique for a DIFFERENT requirement: A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The Timberline Foods failure described here instead concerns A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. That choice does not establish the required correction; the acceptance result must be: A failing agent trace identifies the specific tool and error without storing sensitive prompt contents.

Require a human confirmation checkpoint and deterministic amount verification before authorizing any payment write. This is a plausible technique for a DIFFERENT requirement: A generative agent automatically approves vendor payments based on free-form text without human approval. The Timberline Foods failure described here instead concerns A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. That choice does not establish the required correction; the acceptance result must be: A failing agent trace identifies the specific tool and error without storing sensitive prompt contents.

Treat retrieved document text as untrusted data and restrict tools, secrets and prompt-following privileges at the execution boundary. This is a plausible technique for a DIFFERENT requirement: A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The Timberline Foods failure described here instead concerns A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. That choice does not establish the required correction; the acceptance result must be: A failing agent trace identifies the specific tool and error without storing sensitive prompt contents.

Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call. Such evidence would validate a different change: A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. It follows the separate remedy Enforce least-privilege authorization at the MCP tool boundary and restrict destructive operations to appropriate identities. The Timberline Foods scenario instead reports A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. The decisive observation must be: A failing agent trace identifies the specific tool and error without storing sensitive prompt contents.

Regression runs expose failures before deployment and version-to-version quality changes are measurable. Such evidence would validate a different change: An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. It follows the separate remedy Create a representative evaluation dataset with accuracy, tool-use, access-control and refusal tests plus release thresholds. The Timberline Foods scenario instead reports A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. The decisive observation must be: A failing agent trace identifies the specific tool and error without storing sensitive prompt contents.

The agent lists only cases the calling user may view and direct database credentials are not present. Such evidence would validate a different change: A custom Foundry agent must query customer cases through enterprise tools but its developer gives it broad direct database access. It follows the separate remedy Expose narrowly scoped Microsoft Power Platform MCP server tools with authenticated authorization per operation. The Timberline Foods scenario instead reports A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. The decisive observation must be: A failing agent trace identifies the specific tool and error without storing sensitive prompt contents.