AB-731 Questions Bank

Grounding is an AI solution pattern used to improve response quality by ensuring the model’s output is based on trusted, relevant information provided at inference time , rather than relying only on what the model “remembers” from training. Therefore, C is correct : grounding anchors responses in specific data sources .

In practical deployments, grounding commonly uses retrieval (often called Retrieval Augmented Generation, or RAG) where the system first finds relevant content from approved sources—such as internal policy documents, product documentation, knowledge bases, or databases—and then includes that content in the prompt context sent to the model. Microsoft’s guidance describes grounding data as information supplied at inference time to help responses become more accurate and relevant because the model is guided by authoritative, up-to-date content that may not have been part of original training.

The other options do not define grounding. A relates to inclusion practices and diversity considerations, which are important for responsible AI but are not what grounding means. B describes transparency/explainability concepts. D relates to model evaluation/communication of limitations. Grounding is specifically about tying outputs to known sources , which reduces hallucinations and improves business trust in the generated responses.

Answer Area

Content filtering controls can prevent AI-generated responses from exposing confidential and sensitive information. Answer: Yes

AI-generated content can unintentionally reveal sensitive information if the generative AI model has access to unsecured data sources. Answer: Yes

To prevent data exposure, only the prompts used by users must be protected by using policies. Answer: No

Yes — Content filtering (and related safety controls) can help reduce the chance that responses contain policy-violating or sensitive outputs by detecting and blocking certain categories of content. While filtering is not a perfect guarantee, it is a recognized control to prevent or reduce exposure risk in outputs (for example, blocking regulated data patterns, disallowed content categories, or unsafe disclosures).

Yes — If a model (or the solution’s retrieval layer) can access poorly governed repositories—such as broadly shared folders, misconfigured SharePoint sites, or unsecured databases—then the system can surface sensitive information in responses even without malicious intent. This is why access control, data classification, and permission hygiene are critical prerequisites for deploying AI assistants grounded in organizational content.

No — Protecting only user prompts is insufficient. Data exposure can occur through multiple paths: retrieved documents, generated outputs, logs/telemetry, training/fine-tuning data, and connector/index configuration. Preventing exposure requires layered controls: data governance (labels, DLP, least privilege), secure connectors, output filtering, auditing, and user training—not prompt policy alone.

Responsible AI is fundamentally about earning and maintaining trust while scaling AI across the enterprise. Option C is the best answer because responsible AI practices (fairness, reliability and safety, privacy and security, transparency, accountability, and inclusiveness) reduce reputational, legal, and operational risk and make adoption sustainable over time. When stakeholders trust that AI is governed, tested, and monitored, the organization can expand AI usage confidently across business units.

The other options are incorrect because they make absolute or counterproductive claims. A is false: responsible AI does not “guarantee” accuracy; it reduces risk and improves assurance, but no model can be guaranteed correct in all contexts. B is the opposite of reality: responsible AI increases the importance of data protection and governance; it does not reduce the need for them. D is also incorrect: responsible AI requires clear ownership and oversight, especially from leadership, because accountability is a core principle. In short, responsible AI matters because it builds stakeholder confidence and provides guardrails that support long-term, scalable, and compliant AI adoption—exactly what executives care about when investing in an AI portfolio.

The requirement is specific: users must build and use declarative agents that can access work data (tenant data / organizational context). Microsoft’s licensing guidance for Copilot extensibility ties use of declarative agents to having the appropriate Copilot entitlement that enables tenant grounding and organizational data access. In Microsoft’s cost and licensing considerations for declarative agents, Microsoft states that to use a declarative agent, users must have a Microsoft 365 Copilot add-on license (or an equivalent Copilot Chat add-on path tied to eligible licensing). Therefore, among the provided options, the best recommendation is A.

Option B (Copilot Studio user license) is primarily about authoring/building agents in Copilot Studio, but it is not, by itself, the licensing prerequisite that grants end users the right to use those agents with full Microsoft 365 Copilot capabilities and work-data grounding inside the Microsoft 365 Copilot environment. Publishing/building can be separate from the end-user entitlement to use the agent with organizational context.

Option C (Copilot Chat pay-as-you-go) can enable usage-based access to declarative agents in some configurations, but the question asks for the best license recommendation for users who need work-data access through declarative agents. The Microsoft 365 Copilot add-on is the straightforward, fully supported entitlement for that scenario.