Question 70 A purchasing agent searches policy, calculates a vendor discount and issues a purchase order before checking the user's spending authority. What prevention measure is most targeted to this underlying cause? Apply per-tool data classifications, payload allowlists and outbound-call logging to agent orchestration. Document the live system of record, row-level access rules and reconciliation tests in the use-case contract. Make spending thresholds and approval gates server-side controls with an immutable tool-call audit trail. Use maximum tool-call budgets and policy checks independent of the language model's generated plans. ExplanationCorrect Answer C:Tool calls are consequential side effects; neither a model prediction nor a retrieved policy paragraph can substitute for an authorization boundary. Other Answers A:That tool calls are consequential side effects; neither a model prediction nor a retrieved policy paragraph can substitute for an authorization boundary. B:Tool calls are consequential side effects; neither a model prediction nor a retrieved policy paragraph can substitute for an authorization boundary. D:This control addresses a different exposure: A support agent repeatedly calls a pricing API because a tool response contains an instruction telling it to refresh itself indefinitely. It would not prevent this failure, because tool calls are consequential side effects; neither a model prediction nor a retrieved policy paragraph can substitute for an authorization boundary.
Question 71 A repair assistant runs public web search after accessing a customer serial number, and accidentally sends the full serial and internal ticket text to the external search endpoint. Which implementation decision best restores the intended behavior? Redact internal identifiers before external research and route private diagnostics only through approved authenticated internal tools. Treat the API response as untrusted data, cap iterations and let the planner choose only authorized tools from a fixed policy. Order the workflow as authenticate, retrieve authorized terms, calculate exact totals, obtain purchase approval and only then call the write tool. Use a Genie data-question workflow tied to governed semantic definitions and permissioned data, rather than selecting document-only Knowledge Assistant. ExplanationCorrect Answer A:The action targets the stated cause: External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. Check the repair by: inspect outbound tool payloads from synthetic private tickets and confirm no serial, address or internal notes leave the trusted boundary. Other Answers B:External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. C:External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. D:External search receives the query as data; a chained prompt does not undo sensitive information already transmitted.
Question 72 A repair assistant runs public web search after accessing a customer serial number, and accidentally sends the full serial and internal ticket text to the external search endpoint. Which underlying technical principle explains why this occurs? Tool calls are consequential side effects; neither a model prediction nor a retrieved policy paragraph can substitute for an authorization boundary. Structured questions require query planning over trusted table semantics and governed data access rather than arbitrary similarity retrieval. A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. ExplanationCorrect Answer D:Redact internal identifiers before external research and route private diagnostics only through approved authenticated internal tools. Other Answers A:External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. B:External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. C:That mechanism describes another problem: A support agent repeatedly calls a pricing API because a tool response contains an instruction telling it to refresh itself indefinitely. It does not explain this case, where external search receives the query as data; a chained prompt does not undo sensitive information already transmitted.
Question 73 A repair assistant runs public web search after accessing a customer serial number, and accidentally sends the full serial and internal ticket text to the external search endpoint. After correction, what targeted test should demonstrate success? Ask a test business question and verify the executed query uses approved tables, metrics and caller privileges. Feed a malicious refresh directive through a mocked tool and verify one bounded attempt, safe termination and trace evidence. Replay an over-limit order and verify no purchase API call occurs before a recorded approval event. Inspect outbound tool payloads from synthetic private tickets and confirm no serial, address or internal notes leave the trusted boundary. ExplanationCorrect Answer D:External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. Other Answers A:Inspect outbound tool payloads from synthetic private tickets and confirm no serial, address or internal notes leave the trusted boundary. B:Inspect outbound tool payloads from synthetic private tickets and confirm no serial, address or internal notes leave the trusted boundary. C:Inspect outbound tool payloads from synthetic private tickets and confirm no serial, address or internal notes leave the trusted boundary.
Question 74 A repair assistant runs public web search after accessing a customer serial number, and accidentally sends the full serial and internal ticket text to the external search endpoint. Which release safeguard most directly addresses this failure class? Use maximum tool-call budgets and policy checks independent of the language model's generated plans. Make spending thresholds and approval gates server-side controls with an immutable tool-call audit trail. Apply per-tool data classifications, payload allowlists and outbound-call logging to agent orchestration. Curate data semantics and test row-level security before enabling business-facing natural-language questions. ExplanationCorrect Answer C:External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. Other Answers A:External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. B:This control addresses a different exposure: A purchasing agent searches policy, calculates a vendor discount and issues a purchase order before checking the user's spending authority. It would not prevent this failure, because external search receives the query as data; a chained prompt does not undo sensitive information already transmitted. D:That external search receives the query as data; a chained prompt does not undo sensitive information already transmitted.
Question 75 A support agent repeatedly calls a pricing API because a tool response contains an instruction telling it to refresh itself indefinitely. Which design change directly satisfies the stated constraints? Redact internal identifiers before external research and route private diagnostics only through approved authenticated internal tools. Treat the API response as untrusted data, cap iterations and let the planner choose only authorized tools from a fixed policy. Order the workflow as authenticate, retrieve authorized terms, calculate exact totals, obtain purchase approval and only then call the write tool. Define typed permit_type, district and submitted_facts inputs, with an eligibility decision, evidence citations and an explicit insufficient_information outcome. ExplanationCorrect Answer B:The action targets the stated cause: A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. Check the repair by: feed a malicious refresh directive through a mocked tool and verify one bounded attempt, safe termination and trace evidence. Other Answers A:A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. C:A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. D:A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution.
Question 76 A support agent repeatedly calls a pricing API because a tool response contains an instruction telling it to refresh itself indefinitely. Which causal explanation best accounts for the failure? External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. Eligibility rules depend on jurisdiction and permit class; the model cannot ground a decision if required policy selectors are missing. Tool calls are consequential side effects; neither a model prediction nor a retrieved policy paragraph can substitute for an authorization boundary. ExplanationCorrect Answer B:Treat the API response as untrusted data, cap iterations and let the planner choose only authorized tools from a fixed policy. Other Answers A:A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. C:That mechanism describes another problem: A city help desk requests permit eligibility answers, but the intake contract contains only a free-text complaint and no permit type or governing district. It does not explain this case, where a tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. D:A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution.
Question 77 A support agent repeatedly calls a pricing API because a tool response contains an instruction telling it to refresh itself indefinitely. Which concrete acceptance test best demonstrates the proposed change works? Feed a malicious refresh directive through a mocked tool and verify one bounded attempt, safe termination and trace evidence. Replay an over-limit order and verify no purchase API call occurs before a recorded approval event. Replay cases spanning two districts and a missing permit type, checking the rule citations and explicit abstention for incomplete inputs. Inspect outbound tool payloads from synthetic private tickets and confirm no serial, address or internal notes leave the trusted boundary. ExplanationCorrect Answer A:A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. Other Answers B:Feed a malicious refresh directive through a mocked tool and verify one bounded attempt, safe termination and trace evidence. C:Feed a malicious refresh directive through a mocked tool and verify one bounded attempt, safe termination and trace evidence. D:Feed a malicious refresh directive through a mocked tool and verify one bounded attempt, safe termination and trace evidence.
Question 78 A support agent repeatedly calls a pricing API because a tool response contains an instruction telling it to refresh itself indefinitely. Which operational practice should be made a durable requirement? Make spending thresholds and approval gates server-side controls with an immutable tool-call audit trail. Apply per-tool data classifications, payload allowlists and outbound-call logging to agent orchestration. Use maximum tool-call budgets and policy checks independent of the language model's generated plans. Require a business-approved input/output contract and missing-field acceptance cases before the first model implementation. ExplanationCorrect Answer C:A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. Other Answers A:This control addresses a different exposure: A purchasing agent searches policy, calculates a vendor discount and issues a purchase order before checking the user's spending authority. It would not prevent this failure, because a tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. B:That a tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution. D:A tool result cannot confer authority on itself; missing loop limits can turn injected instructions into runaway tool execution.
Question 79 A warehouse question requires a stock check and customer notification, but the agent sends a shortage alert before querying the inventory system. What should the implementation team change first to resolve the described defect? Order the workflow as authenticate, retrieve authorized terms, calculate exact totals, obtain purchase approval and only then call the write tool. Read the authoritative warehouse count first, verify the business threshold and customer entitlement, then issue a notification only on confirmed shortage. Define typed permit_type, district and submitted_facts inputs, with an eligibility decision, evidence citations and an explicit insufficient_information outcome. Redact internal identifiers before external research and route private diagnostics only through approved authenticated internal tools. ExplanationCorrect Answer B:The action targets the stated cause: Notification actions depend on a factual observation; executing a downstream action before the read creates false alerts. Check the repair by: simulate in-stock and out-of-stock SKUs and confirm only the verified shortage triggers the message tool. Other Answers A:Notification actions depend on a factual observation; executing a downstream action before the read creates false alerts. C:Notification actions depend on a factual observation; executing a downstream action before the read creates false alerts. D:Notification actions depend on a factual observation; executing a downstream action before the read creates false alerts.
Question 80 A warehouse question requires a stock check and customer notification, but the agent sends a shortage alert before querying the inventory system. Why does the current approach fail under these conditions? External search receives the query as data; a chained prompt does not undo sensitive information already transmitted. Notification actions depend on a factual observation; executing a downstream action before the read creates false alerts. Tool calls are consequential side effects; neither a model prediction nor a retrieved policy paragraph can substitute for an authorization boundary. Eligibility rules depend on jurisdiction and permit class; the model cannot ground a decision if required policy selectors are missing. ExplanationCorrect Answer B:Read the authoritative warehouse count first, verify the business threshold and customer entitlement, then issue a notification only on confirmed shortage. Other Answers A:That mechanism describes another problem: A repair assistant runs public web search after accessing a customer serial number, and accidentally sends the full serial and internal ticket text to the external search endpoint. It does not explain this case, where notification actions depend on a factual observation; executing a downstream action before the read creates false alerts. C:Notification actions depend on a factual observation; executing a downstream action before the read creates false alerts. D:Notification actions depend on a factual observation; executing a downstream action before the read creates false alerts.
