AI-300 Practice Question 26: Foundry Project Isolation
Microsoft Machine Learning Operations Engineer Associate (AI-300) · Test 3 · question 6 of 10
Four product teams at one company will each build their own agents in Microsoft Foundry. Each team's agents, uploaded files, and evaluation results must be kept separate from the other teams', with access controlled per team. At the same time, the platform group wants one place to configure security and connections, and wants all four teams to share the same model deployments rather than each creating their own. How should you structure the Foundry resources?
Show answer and explanation
Answer:
Foundry "organizes AI workloads through a layered architecture: a top-level Foundry resource for governance, projects for development isolation, and connected Azure services". Microsoft lists multi-team access as a named scenario for exactly this shape: "multiple teams need isolated projects with shared model deployments and centralized governance", and explains that "dedicated project containers isolate development activities and provide boundaries for access control, files, agents, and evaluations", letting teams work "reusing existing model deployments and connections without repeated IT setup" (option D).
- A is wrong because the Foundry resource is the governance boundary. One per team means four separate sets of security settings and connections to keep in step, and model deployments that live on one resource are not shared with the others. A shared storage account doesn't recreate the isolation properties a project gives. - B is wrong because folders are not a security boundary. The project is what bounds access control, files, agents, and evaluations, so a single project leaves all four teams sharing one. - C is wrong for the same reason as A, and it adds duplication: four copies of every deployment consume four times the quota and multiply the operational work whenever a model version changes.
Reference: Microsoft Foundry architecture