Microsoft AB-731 AI Transformation Leader Exam Practice Test

Answer Area

Microsoft 365 Copilot connectors enable you to index data from multiple sources to make the data available in Copilot. Answer: Yes

You can build a custom Microsoft 365 Copilot connector when the available connectors do NOT meet your data integration requirements. Answer: Yes

To use Microsoft 365 Copilot connectors, you need a Microsoft Copilot Studio license. Answer: No

Yes — Microsoft 365 Copilot connectors (including synced connectors) are designed to bring external data into Microsoft Graph so it can be semantically indexed and surfaced in Microsoft 365 Copilot experiences. Microsoft explicitly states that synced connectors ingest/crawl content into Microsoft Graph where it’s indexed and then available for Copilot prompts and citations.

Yes — When Microsoft-provided connectors don’t meet integration needs, organizations can create custom connectors (often referred to as Microsoft Graph connectors / custom connector development) to connect other data sources. This is a common extensibility path to index line-of-business repositories and make that content discoverable via Copilot and Microsoft Search.

No — Using Microsoft 365 Copilot connectors does not require a Copilot Studio license. Connectors are generally configured and managed in Microsoft 365 admin/search experiences, and Microsoft’s licensing guidance indicates that users can view connector data in Microsoft 365 Copilot and Microsoft Search with valid Microsoft 365/Office 365 licensing—Copilot Studio licensing is about building agents in Copilot Studio, not a prerequisite to use connectors.

The requirement is to analyze text and identify “people, locations, and companies” mentioned in news articles. This is a classic Named Entity Recognition (NER) / entity extraction scenario, which falls under natural language processing. Azure Language in Foundry Tools is the correct choice because it provides text analytics capabilities that detect and categorize entities in unstructured text—commonly including Person , Location , and Organization . This enables downstream experiences such as topic tagging, search filters (e.g., “all articles mentioning Company X”), trend dashboards (top people/places mentioned this week), and improved content discovery.

The other options do not match the requirement. Content Safety focuses on moderating harmful or policy-violating content (for example, hate, violence, self-harm, sexual content) and is not the primary tool for extracting named entities. Azure Vision is for analyzing images and performing OCR; it would only be relevant if the articles were images or scans, but the task here is entity extraction from text articles. Azure Speech is for speech-to-text, text-to-speech, and audio analysis; it would be used if your input were audio recordings rather than written articles.

Therefore, to identify key entities (people, locations, companies) from daily news article text, the best recommendation is Azure Language in Foundry Tools .

Answer Area

Microsoft 365 Copilot enables users to search across emails, files, chats, meetings, and connected apps, by using natural language queries. Answer: Yes

Microsoft 365 Copilot provides data protection, and helps ensure that user prompts and chat data are secure. Answer: Yes

Microsoft 365 Copilot is included in all Microsoft 365 subscriptions. Answer: No

Yes — Microsoft 365 Copilot is grounded in Microsoft 365 content through Microsoft Graph and is designed to help users find and summarize information across their work context (emails, files, chats, meetings). With extensions/connectors, Copilot can also incorporate information from connected apps, allowing users to query using natural language and get summarized, actionable outputs.

Yes — A key enterprise benefit of Microsoft 365 Copilot is that it operates within the Microsoft 365 security, identity, and compliance boundary. It respects existing permissions (users only get content they are authorized to access) and supports organizational controls intended to protect prompts and generated content. This is part of the business value compared to consumer tools: IT can apply policies, auditing, and compliance controls to reduce data risk.

No — Microsoft 365 Copilot is not automatically included in every Microsoft 365 subscription. In most business scenarios it is licensed as an add-on (or separate Copilot entitlement) for eligible Microsoft 365 plans, meaning it requires explicit licensing rather than being universally bundled with all subscriptions.

This scenario is a clear violation of the fairness principle. Fairness in Microsoft’s Responsible AI framework is about ensuring AI systems do not create unjustified bias or discriminatory outcomes—especially when decisions affect people’s access to opportunities such as credit, employment, housing, or education. A rule or learned behavior that rejects all applicants over a certain age creates a systematic, categorical disadvantage for a protected demographic group and indicates a discriminatory decision boundary rather than an individualized assessment of creditworthiness.

Even if the model designers believed age correlates with risk, using a hard cutoff that rejects every applicant older than 60 is not an equitable approach. It suggests the model is either using age directly as a dominant feature or reflects biased training data/labels that encoded discriminatory outcomes. Fairness requires you to evaluate model outcomes across groups (for example, age brackets), measure disparate impact, and apply mitigations such as feature review (removing or constraining sensitive attributes), rebalancing training data, adjusting thresholds, or using fairness-aware training/evaluation methods. It also requires governance and review of high-stakes automated decisions.

The other principles are not the best match: transparency concerns explainability and user understanding, accountability concerns human oversight and ownership, and reliability and safety concerns consistent and safe operation. The core issue here is discriminatory treatment across an age group— fairness .

Answer Area

Microsoft 365 Copilot can amplify existing data governance challenges.

Answer: Yes

Implementing Microsoft 365 Copilot reduces data management costs.

Answer: No

Microsoft 365 Copilot can help IT teams manage data risks.

Answer: Yes

Yes — Copilot relies on the permissions, sharing links, and content exposure that already exist in Microsoft 365. If an organization has oversharing (for example, broadly accessible SharePoint sites, poorly scoped Teams, unmanaged external sharing, or excessive access rights), Copilot can surface that content more easily through natural-language querying. In other words, Copilot doesn’t create new permissions, but it can increase visibility of governance gaps and make the impact of weak information architecture more apparent.

No — It is not accurate to claim that implementing Copilot inherently reduces data management costs. Adoption often requires up-front investment in data hygiene, sensitivity labeling, retention, permission cleanup, DLP, and change management. Some organizations may realize productivity gains or reduced effort over time, but “reduces costs” is not a guaranteed outcome and depends heavily on the current state of governance, the scale of remediation needed, and how Copilot is rolled out.

Yes — Copilot can support IT risk management when deployed with the right controls: identity and access governance, sensitivity labels, DLP policies, retention, auditing, and compliance tooling. Because Copilot operates within the Microsoft 365 security/compliance boundary and honors existing access controls, IT can apply centralized policies to reduce leakage risk and improve overall control of how organizational data is accessed and used.

 Extract information from invoices and credit notes: Azure Document Intelligence in Foundry Tools

 Identify discussion topics in customer service call recordings: Azure AI Search

 Detect customer sentiment and opinions: Azure AI Search

To minimize development time, you should select services that provide prebuilt extraction and enrichment rather than building custom models.

For invoices and credit notes , the best fit is Azure Document Intelligence because it is purpose-built for intelligent document processing and includes prebuilt models (such as invoice-style extraction) that return structured fields (invoice number, vendor, totals, dates, line items). This directly satisfies “extract information” from financial documents without custom ML training.

For customer service call recordings , the raw input is audio, but the task is to identify “discussion topics,” which is an information discovery and text-enrichment problem once the calls are transcribed. Azure AI Search is the correct recommendation because it can index large collections of content and apply built-in AI enrichment (for example, key phrase extraction and entity extraction) to help derive and query “topics” across many records.

For sentiment and opinions , Azure AI Search is again the best choice in this constrained list because it can run built-in enrichment skills over ingested text (such as transcripts or notes) to annotate content with sentiment-related metadata and then make that enriched data searchable and filterable at scale. This approach delivers fast time-to-value: ingest → enrich → index → query, without standing up a custom training pipeline.

Answer Area

Larger datasets can increase the cost of a generative AI solution that uses an Azure Machine Learning workspace. Answer: Yes

The cost of consuming Azure OpenAI models is primarily identified by the number of input and output tokens processed. Answer: Yes

The cost of custom generative AI solutions always remains the same regardless of the model version or capability used. Answer: No

Yes — In Azure Machine Learning, cost is driven by the resources you consume to store, process, and train. Larger datasets typically require more storage, more data transfer, and more compute time for preprocessing, training, evaluation, and experimentation. Even if you are not training foundation models, handling larger corpora can increase pipeline duration and the number/size of compute instances used, which increases overall cost.

Yes — For Azure OpenAI usage under Standard (on-demand), pricing is primarily tied to token-based consumption (input tokens + output tokens). The more context you send and the longer the generated responses, the more tokens you consume, and the higher the cost. This is why prompt optimization, response length controls, and grounding strategies matter for cost management.

No — Costs vary with model choice and capability. Different model families and versions have different price points, and larger/more capable models generally cost more per token or per unit of throughput. Additionally, architecture choices (RAG, vector search, caching), usage patterns, and throughput requirements can significantly change total cost—so it is never “always the same.”

The correct answers are A and E. A governance program should include a formal process to review AI initiatives for responsible AI alignment. This ensures that projects are assessed for fairness, privacy, security, reliability, transparency, accountability, and business risk before deployment and during operation. Defining accountability norms across business and technical teams is also essential because responsible AI cannot be owned only by engineers or data scientists. Business owners, legal, compliance, security, privacy, and technical teams must understand who approves AI use cases, who monitors outcomes, and who responds when issues occur. Letting departments use separate governance methods creates inconsistency. Focusing only on regulated or sensitive-data systems is too narrow.

The requirement is explicit: users must have access to the Researcher agent in Microsoft 365 Copilot and use it to search across organizational content stored in SharePoint . Microsoft’s licensing guidance for Researcher indicates that Researcher is available to Microsoft 365 business and enterprise users who have a Microsoft 365 Copilot add-on license (and also to certain consumer “Microsoft 365 Premium” subscriptions).

That maps directly to option C . The Researcher agent is part of the Microsoft 365 Copilot experience for work tenants; it is not enabled merely by having a baseline Microsoft 365 subscription entitlement (B). Baseline subscriptions can provide access to Microsoft 365 apps and content repositories (like SharePoint/OneDrive), but the Researcher agent itself is a Copilot capability that requires the Copilot add-on to unlock.

Option A (pay-as-you-go) and D (usage-based consumption license in Azure) describe consumption models that apply to Azure services or agent metering in some scenarios, but they are not the standard licensing requirement to enable the built-in Researcher agent for Microsoft 365 Copilot users. When the goal is to enable Researcher inside Microsoft 365 Copilot for staff, the practical and correct recommendation is to assign the Microsoft 365 Copilot per-user add-on license to the users who need it, ensuring their SharePoint access is already properly permissioned and governed.

uses structured data and provides insights by using text, charts, tables, and other visuals.

The Analyst agent in Microsoft 365 Copilot is positioned as a “data analysis” reasoning agent that helps users work through structured information (for example, tables, spreadsheets, and other dataset-like inputs) and then produces analytical outputs . The best completion is the option stating it “uses structured data and provides insights by using text, charts, tables, and other visuals,” because that describes the hallmark outcome of analyst-style work: summarizing patterns, highlighting key drivers, and presenting results in formats that business users can act on. Analyst-style assistance typically includes exploring the data, identifying trends and anomalies, comparing segments, and explaining findings clearly—often accompanied by tables and visual representations that make the insights easier to consume.

The other dropdown options align to different use cases: “compiles background research for a new market or initiative” describes a research-oriented agent, “generate audio summaries” is a media summarization function, and “answer employee FAQs” describes a conversational knowledge assistant. Analyst is the one most directly associated with structured-data interpretation and producing a mix of narrative plus analytical artifacts (tables/charts) to communicate conclusions.

Most generative AI language model pricing is based on token consumption , which measures the amount of text processed by the model. Tokens are sub-word units used internally by language models (for example, parts of words, whole words, or punctuation). When you send a prompt, the model consumes input tokens (your prompt + any system instructions + retrieved grounding context). When it generates a response, it consumes output tokens (the generated completion). Costs typically scale with the total input + output tokens processed, which is why long prompts, large grounding passages, and lengthy responses increase spend. This also explains why prompt optimization, response length limits, caching, and careful grounding are common cost-control techniques in enterprise solutions.

By contrast, “documents” is too coarse (a document can be 1 page or 500 pages). “Requests” is not the primary unit for most LLM pricing models because request sizes vary dramatically. “Words” is not used because the model’s actual compute unit is tokens, and tokenization differs across languages and text patterns. Therefore, the most accurate completion is tokens .

Answer Area

Microsoft Copilot provides a single AI app that has identical features and experiences across all Microsoft products. Answer: No

Microsoft 365 Copilot delivers AI capabilities for business users that use Microsoft 365 apps. Answer: Yes

Microsoft Security Copilot helps companies understand risks and the organizational security posture. Answer: Yes

No — “Copilot” is an umbrella brand across Microsoft, but the experiences are not identical . Different Copilots target different workloads (productivity, security, development, business apps) and therefore expose different capabilities, connectors, permissions models, and admin controls. For example, Microsoft 365 Copilot is embedded in Word/Excel/PowerPoint/Outlook/Teams, while Security Copilot is built for SOC workflows and integrates with security tooling; they are intentionally not the same app with the same features.

Yes — Microsoft 365 Copilot is specifically designed to deliver generative AI assistance for users working in Microsoft 365 applications . It enhances common business tasks such as drafting, summarizing, meeting recap, creating presentations, and working with documents and communications—directly inside the Microsoft 365 productivity suite.

Yes — Microsoft Security Copilot is focused on security operations and helps analysts understand threats, investigate incidents, and improve visibility into security posture. Its purpose is aligned with helping organizations interpret security signals and risk context more efficiently, which supports understanding organizational risk and posture.

The requirement has two key phrases: indexing information and knowledge mining by extracting insights from documents . The Microsoft service purpose-built for this is Azure AI Search (formerly Azure Cognitive Search), which provides a search index over your content and supports “AI enrichment” workflows to extract and structure insights from documents during indexing.

Azure AI Search can ingest content from common enterprise sources (files, blobs, databases), build searchable indexes, and enrich the indexed content using built-in skills or integrated AI capabilities—such as entity recognition, key phrase extraction, language detection, and OCR (depending on the pipeline). This is exactly what “knowledge mining” refers to: turning large volumes of unstructured documents into structured, searchable knowledge that applications and users can query.

The other choices are partial fits: Azure Vision focuses on image/video analysis, not general document indexing. Azure Document Intelligence is excellent for extracting fields/tables from forms and documents, but on its own it does not provide the full indexing/search and knowledge mining layer across a corpus. Microsoft Foundry is an overarching platform for building AI apps/agents; it can incorporate search, but the specific service that directly delivers indexing + knowledge mining is Azure AI Search .

Answer Area

A manufacturer can use Azure Vision in Foundry Tools to identify product defects on an assembly line. Answer: Yes

A logistics company can use Azure Vision in Foundry Tools to recognize package shipping labels. Answer: Yes

The HR department at your company can only use Azure Vision in Foundry Tools to extract written content from Microsoft Word files. Answer: No

Azure Vision in Foundry Tools provides computer vision capabilities to analyze images, including identifying visual features and reading text with OCR. Because it is designed to “analyze images” and support vision scenarios, it can be applied to manufacturing quality inspection use cases where the goal is to detect anomalies/defects from images captured on a production line. This aligns with statement 1 being Yes .

Statement 2 is also Yes because recognizing shipping labels is fundamentally text extraction from images (often plus some layout/field parsing). Azure Vision supports optical character recognition (OCR) to read printed text from images, and Microsoft documentation explicitly notes OCR can extract text from images such as product labels and similar real-world text surfaces—making shipping labels a direct fit.

Statement 3 is No because it is incorrectly restrictive. Azure Vision is not limited to extracting written content from Word documents, nor is OCR restricted to Word files. Vision capabilities apply broadly to images (and, depending on the capability, various document/image inputs) for tasks like image analysis and text recognition. HR could use it for many scenarios such as extracting text from scanned images, photos, or other visual inputs—not “only” Word files.

For a user to access organizational data from a mobile device, the user needs a Microsoft 365 Copilot license. No

To reason over your organizational data by using Microsoft Graph, you need a Microsoft 365 Copilot license. Yes

To use the Analyst agent, you need a Microsoft 365 Copilot license. Yes

Top of Form

Bottom of Form

The key distinction here is between Copilot Chat capabilities available with a standard Microsoft 365 subscription and the full Microsoft 365 Copilot add-on that enables richer, in-context experiences grounded in organizational data.

Mobile access to organizational data does not inherently require a Microsoft 365 Copilot license. Microsoft’s Microsoft 365 Copilot app (and related mobile experiences) can provide Copilot Chat for work/school accounts with a Microsoft 365 license, so simply accessing organizational content on a mobile device is not the same as having the paid Copilot add-on. The statement claims a Copilot license is required just to access org data from mobile, which is too broad—there are mobile Microsoft 365 apps that access org data without the Copilot add-on.

Reasoning over organizational data via Microsoft Graph is a core value proposition of Microsoft 365 Copilot. Microsoft documents explain that Microsoft 365 Copilot connects LLMs to your organization’s content and context through Microsoft Graph and generates responses “anchored” in organizational data. That deeper integration is tied to the Microsoft 365 Copilot experience (an add-on license).

Analyst is a “reasoning agent” within Microsoft 365 Copilot and Microsoft states that users with a Microsoft 365 Copilot license can use Analyst (with defined usage limits). Therefore, the Analyst agent requires the Microsoft 365 Copilot license.

Microsoft Copilot Studio is built for creating and managing custom agents that handle employee self-service and business process automation. The two capabilities that align directly to this purpose are D and E .

D is correct because Copilot Studio lets you build agents that connect to enterprise data and systems and then perform actions on behalf of users. This is the foundation for automation and self-service: the agent can answer questions using connected knowledge sources and can also trigger workflows (for example, submitting a request, creating a ticket, checking status, or updating records) through connectors and actions. These integrations allow the agent to move beyond “chat” into real operational outcomes, which is exactly what business process automation requires.

E is correct because Copilot Studio provides the controls needed to customize how an agent behaves and responds. This includes defining conversational topics/flows, setting instructions and guardrails, shaping tone and response style, configuring fallback behavior, and controlling how generative answers are produced (for example, using approved knowledge sources). Customization ensures the agent behaves consistently with company policies and provides reliable employee experiences.

The other choices represent different Microsoft products: A is aligned to security operations tooling (Security Copilot), B relates to information protection/governance (Purview), and C is a Microsoft 365 Copilot capability inside Word/PowerPoint rather than a Copilot Studio feature.

The correct selections are Yes, Yes, Yes. Lack of trust is a common AI adoption barrier because users and leaders may worry about security, privacy, hallucinations, inaccurate outputs, and unclear accountability. If people do not trust the system, they will avoid using it or over-escalate decisions outside the intended workflow. AI adoption also fails when organizations overlook high-quality data. Poor, outdated, incomplete, or poorly governed data weakens grounding, reduces output quality, and damages user confidence. Finally, adoption is strongest when business and compliance stakeholders are involved early. Business stakeholders ensure the solution solves real problems and delivers measurable value, while compliance, legal, risk, and privacy teams ensure the solution aligns with policy and regulatory obligations.

Answer Area

Retrieval Augmented Generation RAG requires model fine-tuning. Answer: No

Retrieval Augmented Generation RAG is helpful when you need a generative AI solution that can access current, verifiable information. Answer: Yes

Retrieval Augmented Generation RAG enables you to get more relevant responses based on your organization’s documents without retraining the base model. Answer: Yes

RAG is an architecture pattern that improves generative AI responses by retrieving relevant information from external knowledge sources (for example, a document index, database, or knowledge base) and injecting that information into the model’s prompt/context at runtime.

No — RAG does not inherently require fine-tuning. Fine-tuning changes the model weights. RAG, instead, keeps the base model as-is and augments it with retrieved context. Fine-tuning can be complementary (for style, domain tone, or specialized tasks), but it is not required for RAG to work.

Yes — RAG is especially valuable when you need current and verifiable information because the retrieval layer can pull the latest approved content (updated policies, product specs, incident runbooks) and provide it to the model. This reduces hallucinations and makes answers traceable to known sources.

Yes — A major benefit of RAG is improved relevance to organizational documents without retraining. Instead of rebuilding the model whenever documents change, you update the underlying content store/index; the model then generates responses grounded in the retrieved passages, producing answers that align with your organization’s latest information and terminology.

Microsoft Foundry is positioned as a unified platform experience for building, optimizing, and governing AI applications and agents. Microsoft explicitly emphasizes “fleetwide security and governance” and the ability to build and manage AI in a unified environment, which directly supports statement 1 being Yes : it is designed to help organizations build and operate generative AI solutions with centralized governance controls (for example, environment setup, data isolation, access control, and operational management).

For statement 2, Foundry supports scaling as demand increases . Microsoft documentation for Foundry-related model usage notes that as usage grows, Foundry can automatically increase quotas by moving users to higher tiers (and allows requesting additional quota). This is a concrete scalability mechanism tied to increased workload demand, so the statement is Yes .

For statement 3, Foundry is not limited to text-only generative AI. Microsoft provides “Azure Vision in Foundry Tools,” which delivers computer vision capabilities such as analyzing images, reading text (OCR), and other image-processing features. That means Foundry can be used for image recognition/computer vision workloads, so the statement is Yes .

Answer Area

Extracting structured data from forms and invoices: Answer: Azure Document Intelligence in Foundry Tools

Summarizing written content from business reports: Answer: Azure Language in Foundry Tools

Generating descriptive text for uploaded images: Answer: Azure Vision in Foundry Tools

These three tasks align to three different Azure AI capability families: document processing, language understanding/generation, and computer vision.

Forms and invoices are semi-structured documents where the business need is to extract specific fields (IDs, names, totals, dates) reliably into structured output. Azure Document Intelligence is designed for intelligent document processing and includes prebuilt models (such as invoices) as well as custom extraction options, making it the correct choice for structured data extraction from documents.

Summarizing written business reports is an NLP task focused on compressing long text into key points, themes, and action items. Azure Language provides language processing capabilities (including summarization features within language service capabilities), so it is the best fit for summarization scenarios.

Generating descriptive text for images (image captioning/description) is a computer vision task. Azure Vision can analyze uploaded images and return descriptions/captions and other visual insights, which directly matches the requirement to produce descriptive text from images.

For a product showcase website, the highest-impact, most directly relevant generative AI benefit is content creation at scale —producing consistent, high-quality product copy quickly. Option D matches a core generative AI capability: turning structured inputs (specifications such as dimensions, materials, features, compatibility, and use cases) into natural-language descriptions that are readable, persuasive, and formatted for web publishing. This accelerates catalog onboarding, reduces manual writing effort, and helps maintain a consistent tone and structure across thousands of SKUs.

Option A (translation) is also something generative AI can do, but it is a narrower, secondary capability compared to the primary website need: generating product copy from specs. Option B is predictive/analytical AI rather than generative content creation. Option C is plausible in ideation, but the scenario is about showcasing existing products, not inventing new ones. Therefore, D is the best answer because it aligns directly with the project’s core workflow (product specs → publishable descriptions) and delivers measurable business value through speed, consistency, and reduced content production costs.

The problem is harmful output language (inappropriate or exclusionary/ableist content). The requirement says you must prevent those responses while minimizing costs . The most cost-effective and direct control is to add a content-moderation filter (B) to screen and block (or rewrite/escalate) responses that violate your safety or inclusion standards. Moderation can be applied at the output stage (and often also at input) without retraining the model, which keeps costs and delivery time low. It also provides an immediate safety layer even if the underlying model occasionally produces biased or exclusionary phrasing.

Option A is not reliable: a newer model version might reduce issues but does not guarantee elimination of ableist language, and you still need policy enforcement. Option C (retraining on only inclusive content) can help, but it is typically expensive (data curation, re-training, re-evaluation, regression testing, re-deployment) and not the “minimize costs” path—also it can reduce coverage/utility if overly restrictive. Option D is clearly wrong because it would amplify the harmful behavior.

In practice, the lowest-cost, high-impact approach is to implement moderation thresholds and handling actions (block, warn, regenerate with constraints, human review) and then, if needed, follow up later with deeper mitigations like prompt constraints, targeted fine-tuning, red-teaming, and continuous evaluation.

The strongest privacy risk mitigation for analyzing customer feedback is to minimize personal data exposure while preserving the analytical value of the text. A is best because anonymizing (or de-identifying) the dataset removes direct identifiers (names, emails, phone numbers, addresses, account IDs) and reduces the likelihood of privacy breaches, unauthorized re-identification, or inadvertent leakage in model outputs. This aligns with privacy-by-design and the general principle of data minimization: only retain the information necessary for the business purpose.

B is usually impractical and undermines business value and auditability; organizations often need retention windows for validation, traceability, and improvement. C is not the best privacy mitigation: keeping data attributable to individuals increases privacy exposure; while deletion-on-request is important for compliance, it’s not the primary mechanism to reduce privacy risk during analysis. D is explicitly poor practice; privacy reviews should occur throughout the lifecycle (requirements, design, data acquisition, testing, deployment, monitoring), not only at the end. Therefore, anonymizing/removing PII at the source is the best first-line approach.

Answer Area

Content filtering controls can prevent AI-generated responses from exposing confidential and sensitive information. Answer: Yes

AI-generated content can unintentionally reveal sensitive information if the generative AI model has access to unsecured data sources. Answer: Yes

To prevent data exposure, only the prompts used by users must be protected by using policies. Answer: No

Yes — Content filtering (and related safety controls) can help reduce the chance that responses contain policy-violating or sensitive outputs by detecting and blocking certain categories of content. While filtering is not a perfect guarantee, it is a recognized control to prevent or reduce exposure risk in outputs (for example, blocking regulated data patterns, disallowed content categories, or unsafe disclosures).

Yes — If a model (or the solution’s retrieval layer) can access poorly governed repositories—such as broadly shared folders, misconfigured SharePoint sites, or unsecured databases—then the system can surface sensitive information in responses even without malicious intent. This is why access control, data classification, and permission hygiene are critical prerequisites for deploying AI assistants grounded in organizational content.

No — Protecting only user prompts is insufficient. Data exposure can occur through multiple paths: retrieved documents, generated outputs, logs/telemetry, training/fine-tuning data, and connector/index configuration. Preventing exposure requires layered controls: data governance (labels, DLP, least privilege), secure connectors, output filtering, auditing, and user training—not prompt policy alone.

The correct answer is establish a champions program for your company. A champions program helps scale AI adoption because it creates a network of motivated employees who learn AI capabilities, share practical examples, support peers, and identify meaningful use cases within their departments. This is more effective than relying only on awareness campaigns or self-paced courses because champions create continuous peer-led adoption and practical reinforcement. Performance metrics are useful for measuring adoption, but metrics alone do not build confidence or capability. A champions program supports change management by turning early adopters into local advocates who can demonstrate value in real workflows, reduce resistance, gather feedback, and help employees understand how AI tools apply to their daily work.

model inaccuracy

The scenario describes a model producing plausible-sounding content that is factually wrong —a common generative AI failure mode often referred to as a “hallucination.” Since “hallucination” is not offered in the dropdown, the best matching choice is model inaccuracy because the core problem is that the model’s output is incorrect even though it appears confident and coherent.

The other options do not fit the definition of the behavior: data leakage is about sensitive information being exposed (for example, proprietary prompts, secrets, or personal data). Prompt injection is an attack technique where a user tries to override system instructions or cause unsafe actions. Overreliance describes a human/organizational risk —trusting the model too much—rather than the model’s intrinsic behavior of generating incorrect facts. Overreliance can be a consequence of this behavior, but it is not what the behavior itself is called.

In practice, you mitigate this kind of inaccuracy by grounding responses in trusted sources (for example, RAG), constraining prompts with explicit requirements, using verification steps (citations, cross-checking, tool-based validation), and adding human review for high-impact use cases.