AI-103 Practice Question 24: MCP Tool Approval Flow

Microsoft Azure AI Apps and Agents Developer Associate (AI-103) · Test 3 · question 4 of 10

Implement generative AI and agentic solutionsmedium

A platform agent is being connected to an internal MCP server that exposes forty tools. Six are read-only lookups the agent genuinely needs; the rest include operations such as delete_environment and rotate_secrets. Before any write executes, an on-call engineer must see the requested tool name and its arguments and explicitly allow the call. The agent should never even be offered the thirty-four tools outside its remit.

How should the MCP tool be configured?

Show answer and explanation

Answer:

D. Set allowed_tools to the six tools and require_approval to always, then answer each mcp_approval_request the run emits with an mcp_approval_response

Both halves of the requirement map to documented settings. allowed_tools is the allow list that decides which of the server's tools the agent can see at all, and require_approval set to always makes the run pause and emit an `mcp_approval_request` item naming the server, the tool and the arguments. Your code, or your approval UX, inspects it and posts back an `mcp_approval_response` for the run to continue. Microsoft's best-practice list says exactly this: use an allow list, require approval for high-risk operations, and review the requested tool name and arguments before approving.

- A is wrong on the second half. allowed_tools is real enforcement, but a natural-language instruction is not: the same page warns that tool descriptions, annotations and results from remote MCP servers are untrusted input that can carry indirect prompt injection, which is precisely what talks a model out of its instructions. - B is wrong because a toolbox centralizes credentials, versioning and policy behind one endpoint, valuable, but it does not by itself pause a run for a human decision on an individual call. The approval setting still has to be configured on the tool. - C is wrong because tracing is after the fact. It tells you the environment was deleted; it does not stop the deletion.

Reference: Connect agents to MCP server endpoints

Practice Test 3 ›

Study guides for AI-103

AI engineer roadmap 2026: skills, certs and the orderAI engineer roadmap for 2026: skills to learn in order, AI engineer vs ML engineer, which certifications fit each stage, and what to skip.

AI-200 exam guide: Azure AI Cloud Developer AssociateAI-200 replaced AZ-204: what the Azure AI Cloud Developer exam tests, how it differs from AI-103, price in USD and INR, format and how to prepare.

How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.

AI-901 exam guide: Azure AI Fundamentals after AI-900AI-901 replaced AI-900: learn what changed, how much Python and Microsoft Foundry you need, exam costs in India, and how to prepare.

Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.

Microsoft AI certification path 2026: which exam firstMicrosoft AI certification path for 2026 - AI-901, AB-730, AI-103, AI-200, AI-300, AB-100, AI-500 and GH-300 by role, and which exam to take first.

AI-103 Certification Guide: What Changed From AI-102The AI-103 certification replaced AI-102 in 2026. Exam format, cost, the five skill domains, what changed and how to prepare, with free practice questions.

What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.

Prompt engineering vs RAG vs fine-tuningWhen to use prompt engineering, retrieval-augmented generation, fine-tuning or continued pre-training, compared on cost, freshness, hallucination and privacy.