Get Your CertAI-103PlayCompete
‹ All AI-103 questions

AI-103 Practice Question 22: Network Isolated Agent Tools

Microsoft Azure AI Apps and Agents Developer Associate (AI-103) · Test 3 · question 2 of 10

Plan and manage an Azure AI solutionmedium

A government contractor has deployed a Foundry resource with public network access disabled, a private endpoint for inbound traffic, and virtual network injection for the agent's outbound traffic. Their compliance rule is absolute: no agent traffic may leave the customer-defined network boundary or the Microsoft backbone. An architect has drafted an agent that uses four tools.

Which of these tools violates the rule as designed?

Select one answer
Show answer and explanation

Answer:

  • B. The web search tool, which grounds answers on the public web

Microsoft's tool-support table for network-isolated deployments marks Bing grounding, web search and SharePoint grounding as supported, but over a public endpoint, and calls this out explicitly: these tools "work in network-isolated environments but communicate over the public internet… If your organization requires that all traffic remain within a private network, these tools may not meet your compliance requirements." Where a tool must be blocked outright, Azure Policy is the documented lever.

- A is wrong because the Azure AI Search tool is supported through a private endpoint. (One operational caveat from the same page: if an indexer must traverse private endpoints, set its executionEnvironment to "Private", or indexing fails silently.) - C is wrong because the Azure Functions tool routes through your VNet subnet, as do the MCP, OpenAPI and A2A tools. - D is wrong because code interpreter (like function calling) travels over the Microsoft backbone network, needs no private endpoint, and never traverses the public internet.

Reference: How to configure network isolation for Microsoft Foundry

Practice Test 3 ›

Study guides for AI-103

AI engineer roadmap 2026: skills, certs and the orderAI engineer roadmap for 2026: skills to learn in order, AI engineer vs ML engineer, which certifications fit each stage, and what to skip.
AI-200 exam guide: Azure AI Cloud Developer AssociateAI-200 replaced AZ-204: what the Azure AI Cloud Developer exam tests, how it differs from AI-103, price in USD and INR, format and how to prepare.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
AI-901 exam guide: Azure AI Fundamentals after AI-900AI-901 replaced AI-900: learn what changed, how much Python and Microsoft Foundry you need, exam costs in India, and how to prepare.
Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.
Microsoft AI certification path 2026: which exam firstMicrosoft AI certification path for 2026 - AI-901, AB-730, AI-103, AI-200, AI-300, AB-100, AI-500 and GH-300 by role, and which exam to take first.
AI-103 Certification Guide: What Changed From AI-102The AI-103 certification replaced AI-102 in 2026. Exam format, cost, the five skill domains, what changed and how to prepare, with free practice questions.
What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.
Prompt engineering vs RAG vs fine-tuningWhen to use prompt engineering, retrieval-augmented generation, fine-tuning or continued pre-training, compared on cost, freshness, hallucination and privacy.