The solution does not fully meet the goal. A prompt shield for documents is the correct control for the embedded-instruction portion of the scenario. Microsoft defines Prompt Shields as protection against prompt manipulation, including attacks embedded in third-party or document-like content that is supplied to a generative model. OCR-extracted text from uploaded images is untrusted contextual content, so document attack protection is appropriate for detecting hidden instructions that attempt to override the model's intended behavior.
However, the scenario contains two separate risks: unsafe image uploads and hidden instructions embedded in images. Prompt Shields for documents address indirect prompt injection, but they do not classify or block harmful visual content in the uploaded image itself. Azure AI Content Safety image moderation is the control that scans images for harmful content categories such as sexual content, violence, hate, and self-harm with severity levels that can be used for blocking decisions.
Therefore, document prompt shielding alone is incomplete. A complete mitigation would combine image moderation for unsafe images with Prompt Shields for document attacks, and optionally Spotlighting for lower-trust third-party content. Reference topics: Content Safety image moderation, Prompt Shields, document attacks, indirect prompt injection, and multimodal safety.

The correct intervention point is tool call because the prohibited content must be inspected before Agent1 transmits the MCP request to the external server. Microsoft Foundry defines a tool call as "the action and data the agent proposes to send to a tool." This includes the selected MCP operation and its arguments or payload.
A guardrail configured at this stage evaluates the outbound content immediately before execution. When the Violence risk is detected and the response action is configured as Annotate and block , the tool invocation is not executed, preventing the restricted data from leaving the agent boundary.
The other intervention points operate at different stages. User input scans the original user prompt, but harmful content could subsequently be generated within the tool arguments. Tool response scans information returned by the MCP server, which occurs after the outbound content has already been transmitted. Output scans the final answer delivered to the user and therefore does not control agent-to-tool communication.
This aligns with the AI-103 Study Guide topics Configure safety filters, guardrails, risk detection, and content moderation and Govern agent behavior with oversight modes, constraints, and tool-access controls under responsible AI and agentic systems.

A serverless API deployment exposes a model from the Microsoft Foundry model catalog as a managed inference endpoint without hosting the model on virtual-machine compute in the customer's subscription.
Consequently, it does not consume the subscription's VM-family vCPU quota. Capacity is managed by the service and controlled through deployment-level token and request rate limits rather than customer-managed compute instances.
The generated serverless endpoint uses key authentication. Foundry provides a target URI and associated primary or secondary credentials that the application uses to authorize inference requests. Serverless deployments support the Azure AI Model Inference API, enabling real-time application access through a consistent API interface suitable for REST-based prediction requests.
A self-hosted container requires customer-managed infrastructure and therefore consumes the compute capacity on which it runs. A compute-backed standard deployment generally requires provisioned hosting resources and applicable quota. A batch deployment is designed for asynchronous, high-volume processing rather than interactive real-time inference.
The serverless option therefore satisfies all three requirements simultaneously: key-based authorization, online API inference, and no dependency on the subscription's virtual-machine vCPU quota.
Study Guide alignment: Planning and managing Azure AI solutions - select model deployment options, deploy catalog models, configure endpoint authentication, and evaluate compute and quota requirements.

The best option in this scenario is a custom Azure Content Understanding in Foundry Tools analyzer that defines the required fields as the extracted fields and the returned confidence scores for routing.
Custom Field Targeting with Confidence Scores: Azure Content Understanding allows you to build a document analyzer with a user-defined schema. By defining your required fields (InvoiceNumber, InvoiceDate, VendorName, and TotalAmount), the service will handle extraction across varying layouts and return a dedicated field-level confidence score. You can natively evaluate these confidence metrics to implement your supervisor routing workflow.
RAG-Ready Output Structure: The service naturally returns highly structured JSON payloads.
This makes it perfectly optimized to be ingested directly as grounding data for a Retrieval- Augmented Generation (RAG) agent.
Incorrect:
[Not C]
The prebuilt-layout analyzer extracts raw structural elements such as blocks of text, hierarchy, selection marks, and complete tables. It does not automatically classify or cleanly isolate specific target entities (like vendor name or total amount) into dedicated schema properties, leaving you with heavy post-processing work to isolate the text.
[Not D]
The prebuilt-documentSearch analyzer is optimized for broad, layout-aware text extraction for indexing. Relying on Azure AI Search's search.score for supervisor routing is conceptually flawed; search.score represents a relevance score for a search query ranking rather than an accuracy metric for data extraction confidence.
Reference:
https://learn.microsoft.com/en-us/azure/ai-services/content-understanding/document/analyzer-improvement

Correct:
* You add a reflection pass that regenerates the response if the required clauses are missing.
This is Self-Correction Strategy: A reflection pass allows an agent to evaluate its own initial output against specified constraints (e.g., checking for the presence of mandatory regulatory clauses). If the required text is missing, the agent triggers a programmatic self-correction or regeneration loop to include them before final delivery.
Incorrect:
* You increase the value of the max_tokens parameter.
Increasing the max_tokens parameter prevents the response from being cut off mid-sentence due to length constraints. However, it does not force the model's logic to explicitly include missing information that it chose to leave out earlier in the text.
* You increase the value of the temperature parameter.
Raising the temperature parameter increases randomness and creativity. For rigid compliance tasks like summarizing regulatory documents, higher temperature actually increases the risk of hallucination and omission.
* You run an evaluation flow that scores responses for completeness and blocks responses that fall below a defined threshold.
Evaluation Flow Block: Running an evaluation flow to score completeness and blocking bad responses identifies and stops low-quality outputs, but it does not fix or actively improve the response completeness. It simply filters failures out of the system.
Reference:
https://pub.towardsai.net/reflection-with-llm-how-to-make-ai-review-its-own-work-2db122fca1d8