Question 420 A web application invokes an LLM serving endpoint using a developer's long-lived personal access token baked into front-end JavaScript. Which verification is strongest for this particular failure mode? Submit cross-tenant record IDs and verify the retrieval/tool layers reject them regardless of model output. Inspect compiled assets for tokens, test requests with and without required permissions, and verify audit identity. Sign in as a test user and verify a chat question invokes the right endpoint without exposing tokens. Execute an inference as the principal with and without the minimal query grant, confirming expected allow/deny behavior. ExplanationCorrect Answer B:Browser code exposes embedded secrets to users; endpoint access must be authenticated and authorized at a trusted server boundary. Other Answers A:Inspect compiled assets for tokens, test requests with and without required permissions, and verify audit identity. C:Inspect compiled assets for tokens, test requests with and without required permissions, and verify audit identity. D:Inspect compiled assets for tokens, test requests with and without required permissions, and verify audit identity.
Question 421 A web application invokes an LLM serving endpoint using a developer's long-lived personal access token baked into front-end JavaScript. What change to engineering governance would reduce this risk over time? Use managed identities, secret rotation and least-privilege endpoint grants instead of hard-coded personal tokens. Define endpoint-specific service-principal roles and negative authorization tests in infrastructure-as-code. Separate tenant principals or scoped access policies and review access traces regularly. Require secret scanning, short-lived credentials and egress controls for custom MCP services. ExplanationCorrect Answer A:Browser code exposes embedded secrets to users; endpoint access must be authenticated and authorized at a trusted server boundary. Other Answers B:That browser code exposes embedded secrets to users; endpoint access must be authenticated and authorized at a trusted server boundary. C:Browser code exposes embedded secrets to users; endpoint access must be authenticated and authorized at a trusted server boundary. D:This control addresses a different exposure: An engineering team hosts a custom MCP server in a Databricks App but passes API keys through plain prompt text rather than through authenticated tool transport. It would not prevent this failure, because browser code exposes embedded secrets to users; endpoint access must be authenticated and authorized at a trusted server boundary.
Question 422 A service principal can view an endpoint but receives an authorization error when attempting inference from a production agent. Which engineering action most directly addresses this specific requirement? Enforce per-tenant authorization in the data/tools layer and use an appropriately scoped serving identity rather than trusting a prompt. Grant the principal the appropriate endpoint query permission after checking workspace policy and remove unrelated broad privileges. Remove the client-side secret and use approved service or user authorization through a backend with only required endpoint permissions. Request minimal catalog/schema and model creation permissions for the release service principal rather than granting workspace admin. ExplanationCorrect Answer B:The action targets the stated cause: Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. Check the repair by: execute an inference as the principal with and without the minimal query grant, confirming expected allow/deny behavior. Other Answers A:Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. C:Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. D:Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint.
Question 423 A service principal can view an endpoint but receives an authorization error when attempting inference from a production agent. What architectural constraint is most directly responsible? Browser code exposes embedded secrets to users; endpoint access must be authenticated and authorized at a trusted server boundary. Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement. Unity Catalog evaluates authorization on its securables; notebook execution alone does not confer model-registration rights. ExplanationCorrect Answer B:Grant the principal the appropriate endpoint query permission after checking workspace policy and remove unrelated broad privileges. Other Answers A:Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. C:Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. D:That mechanism describes another problem: A developer can create models in a sandbox schema but fails to register the production model after deployment due to missing UC privileges. It does not explain this case, where discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint.
Question 424 A service principal can view an endpoint but receives an authorization error when attempting inference from a production agent. What validation evidence would most specifically confirm the resolution? Inspect compiled assets for tokens, test requests with and without required permissions, and verify audit identity. Execute an inference as the principal with and without the minimal query grant, confirming expected allow/deny behavior. Attempt registration with a scoped principal, verify expected denial before grants and success after least-privilege grants. Submit cross-tenant record IDs and verify the retrieval/tool layers reject them regardless of model output. ExplanationCorrect Answer B:Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. Other Answers A:Execute an inference as the principal with and without the minimal query grant, confirming expected allow/deny behavior. C:Execute an inference as the principal with and without the minimal query grant, confirming expected allow/deny behavior. D:Execute an inference as the principal with and without the minimal query grant, confirming expected allow/deny behavior.
Question 425 A service principal can view an endpoint but receives an authorization error when attempting inference from a production agent. What prevention measure is most targeted to this underlying cause? Define endpoint-specific service-principal roles and negative authorization tests in infrastructure-as-code. Use managed identities, secret rotation and least-privilege endpoint grants instead of hard-coded personal tokens. Manage registry grants through reviewed deployment identities and auditable permission policies. Separate tenant principals or scoped access policies and review access traces regularly. ExplanationCorrect Answer A:Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. Other Answers B:Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. C:This control addresses a different exposure: A developer can create models in a sandbox schema but fails to register the production model after deployment due to missing UC privileges. It would not prevent this failure, because discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. D:That discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint.
Question 426 A multi-tenant app shares one high-privilege endpoint identity with every tenant and lets a prompt decide which records can be retrieved. Which implementation decision best restores the intended behavior? Use an approved user-authorization pattern or enforce equivalent per-user data access checks behind the app service. Grant the principal the appropriate endpoint query permission after checking workspace policy and remove unrelated broad privileges. Remove the client-side secret and use approved service or user authorization through a backend with only required endpoint permissions. Enforce per-tenant authorization in the data/tools layer and use an appropriately scoped serving identity rather than trusting a prompt. ExplanationCorrect Answer D:The action targets the stated cause: A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement. Check the repair by: submit cross-tenant record IDs and verify the retrieval/tool layers reject them regardless of model output. Other Answers A:A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement. B:A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement. C:A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement.
Question 427 A multi-tenant app shares one high-privilege endpoint identity with every tenant and lets a prompt decide which records can be retrieved. Which underlying technical principle explains why this occurs? Discovery or viewing permissions do not necessarily include permission to invoke a Model Serving endpoint. Browser code exposes embedded secrets to users; endpoint access must be authenticated and authorized at a trusted server boundary. A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement. The app service identity can have broader permissions than the caller; its successful query does not establish user entitlement. ExplanationCorrect Answer C:Enforce per-tenant authorization in the data/tools layer and use an appropriately scoped serving identity rather than trusting a prompt. Other Answers A:A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement. B:That mechanism describes another problem: A web application invokes an LLM serving endpoint using a developer's long-lived personal access token baked into front-end JavaScript. It does not explain this case, where a model endpoint credential is not a substitute for row-level or source-document entitlement enforcement. D:A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement.
Question 428 A multi-tenant app shares one high-privilege endpoint identity with every tenant and lets a prompt decide which records can be retrieved. After correction, what targeted test should demonstrate success? Submit cross-tenant record IDs and verify the retrieval/tool layers reject them regardless of model output. Check only whether two users receive different displayed chat messages, without testing the data/tool-layer entitlements. Execute an inference as the principal with and without the minimal query grant, confirming expected allow/deny behavior. Inspect compiled assets for tokens, test requests with and without required permissions, and verify audit identity. ExplanationCorrect Answer A:A model endpoint credential is not a substitute for row-level or source-document entitlement enforcement. Other Answers B:Different output wording is not proof that a shared high-privilege tool blocked unauthorized rows. The acceptance test must exercise cross-tenant tool authorization. C:Submit cross-tenant record IDs and verify the retrieval/tool layers reject them regardless of model output. D:Submit cross-tenant record IDs and verify the retrieval/tool layers reject them regardless of model output.
Question 429 A deterministic workflow must fetch three customer facts, compute a balance and format one response, but an engineer adds an unbounded agent planning loop. What should the implementation team change first to resolve the described defect? Build a fixed chain of validated retrieval, deterministic calculation and response formatting components with explicit error exits. Calculate the total from validated structured rows before invoking summarization, then present the checked number in the response. Serialize retrieved text into a bounded clearly labeled untrusted context field and apply a prompt-injection safe instruction hierarchy. Convert provider responses into a stable JSON-compatible typed output in post-processing, rejecting missing or invalid fields. ExplanationCorrect Answer A:The action targets the stated cause: A known dependency order does not require dynamic autonomous planning, which adds unnecessary unpredictability and cost. Check the repair by: run test customers including missing account IDs and verify the exact stage order and returned totals. Other Answers B:A known dependency order does not require dynamic autonomous planning, which adds unnecessary unpredictability and cost. C:A known dependency order does not require dynamic autonomous planning, which adds unnecessary unpredictability and cost. D:A known dependency order does not require dynamic autonomous planning, which adds unnecessary unpredictability and cost.
Question 430 A deterministic workflow must fetch three customer facts, compute a balance and format one response, but an engineer adds an unbounded agent planning loop. Why does the current approach fail under these conditions? SDK response objects are not necessarily serving wire-format values; pyfunc output must satisfy the declared interface. Tool data and developer instructions have different trust levels; accidental string interpolation can blur that boundary. Lossy natural-language summary cannot be an authoritative intermediate representation for exact arithmetic. A known dependency order does not require dynamic autonomous planning, which adds unnecessary unpredictability and cost. ExplanationCorrect Answer D:Build a fixed chain of validated retrieval, deterministic calculation and response formatting components with explicit error exits. Other Answers A:A known dependency order does not require dynamic autonomous planning, which adds unnecessary unpredictability and cost. B:That mechanism describes another problem: A simple retrieval-plus-generation chain forwards raw tool output without escaping delimiters, allowing a document to overwrite the next prompt instruction. It does not explain this case, where a known dependency order does not require dynamic autonomous planning, which adds unnecessary unpredictability and cost. C:A known dependency order does not require dynamic autonomous planning, which adds unnecessary unpredictability and cost.
