RBAC & Data Residency — AI-500 Practice Question
A representative Microsoft Multi-Agent AI Solutions Expert (AI-500) exam question on RBAC & Data Residency. Work through it below, then read why each option is right or wrong.
This question is part of the free Microsoft Multi-Agent AI Solutions Expert practice test.
Short answer
The correct answer is B. Block the request immediately and require the agent to use a regional Key Vault instance in the EU; configure network boundaries (service endpoints or private endpoints) to enforce data residency, and log the violation attempt for compliance audit..
The correct answer prioritizes data residency compliance by blocking cross-region access and enforcing regional Key Vault instances with network boundaries (service endpoints or private endpoints prevent data exfiltration). This is the only response that actually enforces the regulatory requirement. Another option allows the violation to occur, merely adding authentication friction. Another option delegates the decision to the customer, which is inappropriate for a regulatory requirement that is the company's responsibility. Another option uses conditional access (designed for user sign-in) to permit a violation rather than prevent it. The question tests whether the candidate understands that data residency is a hard boundary, not a monitoring or audit concern.
The Question
A subscription software company operates a multi-agent system that manages customer provisioning, license allocation, and billing across EU, US, and APAC data centers. Regulations require that customer data never leave its resident region. The company currently uses a single Azure OpenAI deployment in the US East region for all agents globally. Agents must retrieve customer encryption keys from Key Vault to decrypt billing records. A monitoring alert fires when an agent in the EU attempts to access the US-based Key Vault, but the company is unsure whether to block the request, log it for audit, or allow it with additional authentication. What is the most appropriate monitoring response?
Why B is correct
The correct answer prioritizes data residency compliance by blocking cross-region access and enforcing regional Key Vault instances with network boundaries (service endpoints or private endpoints prevent data exfiltration). This is the only response that actually enforces the regulatory requirement. Another option allows the violation to occur, merely adding authentication friction. Another option delegates the decision to the customer, which is inappropriate for a regulatory requirement that is the company's responsibility. Another option uses conditional access (designed for user sign-in) to permit a violation rather than prevent it. The question tests whether the candidate understands that data residency is a hard boundary, not a monitoring or audit concern.
Why the other options are wrong
Option A does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (B) is the only one that fully meets every constraint stated in the question.
Option C does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (B) is the only one that fully meets every constraint stated in the question.
Option D does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (B) is the only one that fully meets every constraint stated in the question.
Key idea: RBAC & Data Residency
The correct answer prioritizes data residency compliance by blocking cross-region access and enforcing regional Key Vault instances with network boundaries (service endpoints or private endpoints prevent data exfiltration). This is the only response that actually enforces the regulatory requirement. Another option allows the violation to occur, merely adding authentication friction. Another option delegates the decision to the customer, which is inappropriate for a regulatory requirement that is the company's responsibility. Another option uses conditional access (designed for user sign-in) to permit a violation rather than prevent it. The question tests whether the candidate understands that data residency is a hard boundary, not a monitoring or audit concern. On the AI-500 exam, questions in the "Secure, govern, and deploy multi-agent solutions" domain test whether you can map a scenario's constraints to the right choice. Read the requirement carefully, eliminate options that violate any single constraint, and pick the one that satisfies all of them with the least operational overhead.
Ready to see how you'd score?
Take the free practice quiz and find out which Microsoft Multi-Agent AI Solutions Expert domains you need to focus on. No signup required.
Practice 5 similar questions
Same cert, same or adjacent domain. Use these after reviewing the explanation.
Related Microsoft Multi-Agent AI Solutions Expert Practice Questions
Official sources used
Verify program and exam details at the source before scheduling.