A model on its own can only produce text. An agent is a model given tools, so it can look things up, call systems and change data. Everything interesting and everything dangerous about agents follows from that.
The four kinds of tool
Extensions are interfaces the agent calls directly to reach an external service. The agent is told what the extension does and invokes it itself.
Functions are code the agent asks your application to run. It decides a function should be called and with what arguments, and hands that back to your side to execute. The difference from an extension is where execution happens, which decides who holds the credentials and who can refuse.
Data stores give the agent access to information rather than actions. Documents, records, an index it can read from. This is how an agent answers from your content rather than from training data.
Plugins package a capability so it can be attached to an agent without custom work, in the way an integration is added to any other product.
The distinction the exam cares about is action against information. Extensions, functions and plugins let an agent do something. A data store lets it know something.
What an agent calls
Google Cloud services provide the plumbing. Cloud Storage for files, databases for records, Cloud Functions and Cloud Run for code the agent triggers, and the Google Cloud API Library for everything else.
Then a set of pre trained APIs that solve common problems without any training data, and the exam expects you to match one to a described need.
Speech-to-Text turns audio into text. Text-to-Speech does the reverse. Translation API translates text, and Document Translation API does it while preserving a document's layout.
Document AI API extracts structured data from forms, invoices and contracts. Cloud Vision API analyses images, covering labels, text in pictures and object detection. Cloud Video Intelligence API does the equivalent for video. Natural Language API handles entity extraction, sentiment and syntax on text.
The point the exam is making is that a capability often needs no model of your own. A question describing invoice fields being pulled out, or a call being transcribed, is asking you to reach for the API rather than build.
Why tool permissions decide the risk
An agent chooses its next action from text, and some of that text arrives from outside, in a document it retrieved or a message a customer sent. That is the whole of the prompt injection problem, and it becomes serious the moment the agent can act.
The controls are ordinary and they are usually skipped. Give a tool the narrowest permission that does the job, and require a confirmation before anything irreversible or financial. Treat what the agent produces as untrusted input to whatever consumes it, and log every call so a bad outcome can be reconstructed rather than argued about.