Plan and manage an Azure AI solution 1.4 Implement responsible AI across generative AI and agentic systems

An agent uses the Azure AI Search tool.

Study guide skill: Configure safety filters, guardrails, risk detection, and content moderation

Question B2-006

An agent uses the Azure AI Search tool. You add a guardrail control for Indirect attack at the Tool response intervention point (preview) with the action Annotate and block. A document returned by the search tool contains hidden instructions that try to redirect the agent. What happens?

Select one answer.

  • A The search tool's full response payload is scanned before it's added to the agent's memory or returned to the user; the attack is detected and the agent stops, so the content isn't saved and can't steer the agent ✓ Correct answer
  • B Nothing is scanned until the final output to the user, so the agent acts on the hidden instructions first
  • C The user's next prompt is blocked, but the tool response is passed to the agent unchanged
  • D The control has no effect unless Spotlighting is also enabled

Answer: A

At the Tool response intervention point (preview), an Indirect attack control scans the full payload each tool sends back to the agent, before it's added to the agent's memory or returned to the end user. If an attack is detected, the agent stops operating immediately and the malicious content isn't saved or used to steer the agent off-track. Tool call and tool response controls need moderation support from the tool itself; Azure AI Search supports it, and the controls don't take effect for tools that don't. Spotlighting is a separate, optional document-attack defense, and the Output intervention point is a different control.

Deep dive

How it works

Foundry guardrails can be applied directly to agents, at four intervention points: user input, tool call (preview), tool response (preview), and output. Each point scans different content, so where you put a control decides what it can catch.

The Tool response point scans the content a tool sends back, internal to the agent's orchestration and before that content is added to the agent's memory or returned to the end user. With an Indirect attack control set to Annotate and block:

  1. The full payload from each tool is scanned for indirect prompt injection.
  2. If an attack is detected, the agent stops operating immediately.
  3. The malicious content isn't saved by the agent and can't steer it off track.

This only works for tools that support moderation. Azure AI Search is on the supported list, along with Azure Functions, OpenAPI, SharePoint grounding and others. For a tool not on the list, tool call and tool response controls don't take effect.

Expect a small cost. Guardrail processing at each intervention point adds roughly 50 to 100 ms of latency.

The other options, and when you'd use them

  • Nothing is scanned until the final output: The output point is separate. Tool response scanning happens before the content enters the agent's memory or reaches the user.
  • The next user prompt is blocked; the tool response passes unchanged: User-input controls scan user prompts. The tool response control scans the full payload each tool sends back to the agent.
  • No effect unless Spotlighting is enabled: Spotlighting is an optional, additional defense for document attacks, and it's off by default. The indirect attack control works on its own at the tool response point.

Exam tip

Hidden instructions inside tool results = Indirect attack control at the Tool response point, and the tool must support moderation (Azure AI Search does).

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Plan and manage questions · AI-103 study guide

Thanks for your feedback!