Implement security for AI

Oakridge Retail receives a Microsoft Defender XDR alert that an agent identity named agt-pricing-sync, registered in Microsoft Entra Agent ID, authenticated from an anomalous location. Before deciding whether to disable the agent, the SOC analyst must quickly determine which permissions the agent holds, which data sources and downstream resources it can reach, and which other identities or assets an attacker could pivot to if the agent were compromised.

What should the analyst use?

1. AThe Microsoft Entra sign-in logs filtered to the agent identity.Sign-in logs show when and where the agent authenticated, but they do not map the permissions, reachable resources, or possible lateral paths from the identity.
2. BThe agent's page under Assets > AI agents in the Microsoft Defender portal, which shows its risk level and risk indicators, identity and permissions, knowledge sources, attack-surface relationships, recommendations, and active alerts.Microsoft Defender inventories AI agents as assets. The agent page under Assets > AI agents shows the identity's permissions, knowledge sources and tools, attack-surface relationships, risk indicators, and alerts, which together describe the blast radius; the AgentsInfo table in advanced hunting exposes the same properties for queries.
3. CThe Microsoft Purview audit log searched for activities by the agent.Audit records show what the agent has already done, not what it is able to reach. Blast radius analysis is about potential impact, not historical actions.
4. DThe Secure Score page in Microsoft Defender for Cloud.Secure Score aggregates posture recommendations for cloud resources; it does not analyze the reach of a specific identity.

Pinecrest Biologics uses Microsoft 365 E5. The CISO wants a single report that shows how many employees paste sensitive information into third-party generative AI websites from managed devices, which Microsoft 365 Copilot prompts touched labeled files, and recommended one-click policies to reduce the risk. The solution must use built-in Microsoft Purview capabilities and require no custom development.

What should you do first?

1. AIn the Microsoft Purview portal, open Data Security Posture Management for AI, activate it, and enable the recommended default policies.DSPM for AI provides the AI activity reports and one-click recommendations, including an Endpoint DLP policy that detects sensitive data sent to AI sites and a collection policy that captures Copilot interactions for analysis.
2. BCreate a Microsoft Defender for Cloud Apps session policy that blocks uploads to all generative AI cloud apps.A session policy enforces blocking for selected apps through Conditional Access App Control, but it does not produce the consolidated AI risk reporting or Copilot prompt visibility the CISO asked for.
3. CEnable the Data and AI security dashboard in Microsoft Defender for Cloud.The Defender for Cloud dashboard covers AI workloads and data resources deployed in Azure subscriptions, not employee use of Copilot or third-party AI websites.
4. DCreate an insider risk management policy that uses the Risky AI usage template.The insider risk template scores individual users for risky AI activity; it is one of the follow-on policies DSPM for AI recommends, not the starting point for the organization-wide report.

Saltmarsh Legal builds an agent in Microsoft Foundry that answers questions by retrieving clauses from uploaded contracts and passing them to the model as documents. Testers found that a contract containing hidden instructions caused the agent to ignore its system prompt and reveal its configuration. The team must block this behavior at the model deployment level, before the agent is published, by using the built-in guardrails in Foundry.

What should you configure?

1. AEnable the Microsoft Defender for AI Services plan on the subscription that hosts the Foundry project.Defender for AI Services detects and alerts on attacks such as prompt injection, but it does not block them inline or evaluate whether responses are grounded in source documents.
2. BIn Guardrails + controls, create a content filter configuration that enables Prompt Shields for indirect attacks with the action set to Block, apply it to the agent's model deployment, and send retrieved contract text in the documents field so it is evaluated.Prompt Shields for indirect attacks detects injected instructions inside documents the model is given, and the Block action stops the request at the deployment. The filter only evaluates content that is marked as documents, which is why the retrieved text must be passed as documents rather than inline in the user message.
3. CAdd the llm-content-safety policy in API Management in front of the agent endpoint.The gateway policy screens the API request that passes through API Management; documents the agent retrieves after the request reaches it never flow through the gateway, so the injected instructions would not be inspected.
4. DApply a Microsoft Purview DLP policy to the uploaded contracts.DLP controls disclosure of sensitive information; it does not detect embedded instructions in grounding documents.

Corvina Logistics fronts two Microsoft Foundry model deployments with an Azure API Management Premium instance named apim-corvina. Requirements: API Management must authenticate to the Foundry resource without any stored API key; repeated semantically similar prompts must be served from cache to cut model cost; and prompts must be screened for harmful content before they reach the model. The application teams must not change their code.

Which three actions should you perform? Each correct answer presents part of the solution.

1. AEnable a managed identity on apim-corvina, assign it the Cognitive Services OpenAI User role on the Foundry resource, and add the authentication-managed-identity policy to the API.The managed identity obtains a token for the Foundry resource at request time, so no API key is stored in named values or backend credentials, and the role grants only inference rights.
2. BStore the Foundry API key as a secret named value referenced from Azure Key Vault and send it with set-header.Key Vault protects the stored key, but the requirement is that no API key be used at all. A managed identity removes the key entirely.
3. CProvision an Azure Managed Redis cache, configure an embeddings backend, and add the llm-semantic-cache-lookup and llm-semantic-cache-store policies.Semantic caching computes an embedding for the prompt, looks for a similar cached response in a RediSearch-compatible cache such as Azure Managed Redis, and stores new completions, reducing calls to the model without code changes.
4. DAdd the llm-content-safety policy that references an Azure AI Content Safety resource and blocks prompts that exceed the configured category thresholds.The content safety policy sends the prompt to Azure AI Content Safety before forwarding and returns an error when harmful content is detected, enforcing screening at the gateway.
5. EAdd the cache-lookup and cache-store policies with a duration of 3600 seconds keyed on the request URL.Classic response caching matches only identical requests. Chat requests differ in body for every prompt, so URL-keyed caching would almost never hit and does not understand semantic similarity.