Practice questions, answered and explained

A research agent must survey 40 vendor documents and produce a single comparison table. The documents are independent of one another, and coverage matters more than latency. Which orchestration structure best satisfies the requirement?

• A A single agent looping over all 40 of the documents inside one context window

Forty documents will exhaust a single context long before the table is written.

• B Parallel workers appending rows directly to the final table, with no synthesis step

Workers writing straight to the output produce inconsistent, overlapping rows with nothing to reconcile them.

• C A coordinator spawning parallel workers over subsets, then synthesizing their findings

Correct. Parallel workers give the coverage, and the coordinator's synthesis step is what turns 40 partial results into one coherent, de-duplicated table.

• D A sequential pipeline, passing each document's findings into the analysis of the next one

The documents are independent, so sequencing them buys nothing and makes the run forty times longer.

The documents are independent, so nothing is gained by sequencing them, and 40 documents will exhaust a single context. Parallel workers give coverage; the coordinator's synthesis step is what turns 40 partial results into one coherent, de-duplicated table. Workers writing straight to the output produce inconsistent, overlapping rows.

A coordinator fans out eight workers to survey different subsystems. Each worker returns several hundred lines of raw file contents, and the coordinator exhausts its context before it can synthesize. What is the design error?

• A The workers were given read access to a great many files they did not need

Excess read access is untidy but the coordinator's context is exhausted by what is returned, not by what was readable.

• B The coordinator should have used a pipeline so results arrived one at a time

Sequencing the same oversized returns exhausts the context just as surely, only more slowly.

• C Too many workers were spawned in parallel for one coordinator to absorb

Worker count is not the problem; eight compact conclusions would have fitted easily.

• D The workers return raw material rather than conclusions, defeating the isolation

Correct. Subagent isolation exists so bulk reading costs the coordinator only a conclusion, and returning raw contents moves the whole context problem upward.

Subagent isolation exists so that bulk reading costs the coordinator only a conclusion. A worker that returns raw file contents moves the whole context problem up to the coordinator. The fix is an output contract — findings, not transcripts. Sequencing the same oversized returns would exhaust the context just as surely, only slower.

A coordinator spawns a subagent with: "Read auth/session.py, then grep for validate_token, then open the tests, then report whether the refresh flow is safe." What is the primary architectural weakness?

• A The prompt is too long to fit inside a subagent's available context window

The prompt is short; length is not what makes it fail.

• B The coordinator should have done this work inline rather than delegating it out

Delegating the investigation is reasonable — how it was delegated is the problem.

• C The instruction is procedural, so it cannot adapt when step one proves misleading

Correct. Procedural delegation fixes the investigation path before any evidence is in, so a misleading first step still marches through the remaining ones.

• D The subagent has been granted rather more tools than its role actually requires

Tool count is not the flaw; the subagent could do this work with the tools it has.

Procedural delegation fixes the investigation path before any evidence is in. When the first file turns out to be a thin wrapper, the subagent still marches through the remaining steps and reports on the wrong code. A goal-oriented prompt — state the question and the required evidence — lets it follow what it finds.

A team moves to goal-oriented delegation and finds that subagents reach conclusions the coordinator cannot audit. What restores visibility without giving up adaptability?

• A Have the coordinator re-run each subagent's investigation for itself

Re-running each investigation in the coordinator discards the delegation entirely.

• B Return to procedural instructions, so that the path is known in advance

Reverting to procedure gives up the adaptability the team moved to goal-oriented delegation to gain.

• C Require each conclusion to come back with its evidence and its method

Correct. Goal-oriented delegation controls the destination rather than the route, so control is reasserted through the output contract.

• D Reduce each subagent's tool access, so that fewer paths are possible

Narrowing tools limits where the subagent can look without making its reasoning visible.

Goal-oriented delegation controls the destination, not the route — so control is reasserted through the output contract. Requiring evidence and method with every conclusion keeps the coordinator able to audit the reasoning while the subagent stays free to adapt its path.

An engineer asks Claude to migrate an application's authentication layer from server-side sessions to JWTs, touching roughly 30 files. Which review architecture fits best?

• A Plan mode, so the approach and blast radius are approved before any edit

Correct. Wide blast radius, real risk of breaking authentication, and a design decision the human owns is exactly the profile plan mode exists for.

• B Plan mode is unnecessary, since a review of the resulting diff is equivalent

Reviewing 30 files of auth changes after the fact is far more expensive than approving the approach up front.

• C Direct execution, since the change is mechanical once an approach is chosen

The approach is a design decision the human owns, and it is not settled before the work begins.

• D A multi-phase workflow with independent adversarial verifiers per file

Per-file adversarial verification is expensive and addresses precision, which is not the risk here.

Wide blast radius, a real risk of breaking authentication, and a design decision the human owns — that is exactly the profile plan mode exists for: read-only investigation, then an approved plan, then execution. Reviewing 30 files of auth changes after the fact is far more expensive than approving the approach up front.

A developer asks for a null check plus a covering unit test in one small, well-understood module. Which architecture is appropriate?

• A A coordinator-worker fan-out, one for the fix and one for the test

A fan-out over two trivial pieces of work adds coordination overhead for no gain.

• B Direct execution of both the check and the covering test

Correct. The change is narrow, low-risk, and fully specified, so planning and verification stages add ceremony without reducing risk.

• C Plan mode, since every code change should be approved first

Not every code change needs prior approval; architecture is chosen by scope and risk.

• D A multi-phase workflow with a separate verification pass

A separate verification pass costs several times as much for a change a test settles immediately.

Architecture is chosen by scope, risk, and approval need. This change is narrow, low-risk, and fully specified, so planning and verification stages add ceremony without reducing risk. Reserve plan mode and multi-phase workflows for work whose blast radius or uncertainty justifies them.

A synthesis subagent returns: "Found 3 issues. Details are in the file I mentioned earlier." Which principle did the coordinator's prompt violate?

• A Context scoping: the system prompt described far too broad a role for it

Role breadth would produce a vague answer, not a reference to a conversation the subagent never saw.

• B Output schema: the subagent should have been made to call a structured tool

A schema would change the shape of the answer without supplying the missing facts.

• C Self-sufficiency: the prompt must carry every finding the subagent needs

Correct. A subagent starts with a fresh context and sees only the prompt it was handed, so a reference to the coordinator's history points at nothing.

• D Tool restriction: the subagent was given Read access that it did not need

Read access is not the problem; the subagent had nothing to read because the reference was never resolved.

A subagent starts with a fresh context and sees only the prompt it was handed. "The file I mentioned earlier" refers to the coordinator's history, which the subagent never had, so it had nothing to report against. A schema would change the shape of the answer, not supply the missing facts.

You are prompting a verification subagent to test one claimed bug. What does its prompt need in order to complete without a round trip?

• A The claim, its exact location, the code itself, and the bar for refuting it

Correct. Verification needs the specific assertion, where to look, the material to look at, and a defined bar for refutation.

• B The claim, together with an instruction telling the verifier to be skeptical

Skepticism without evidence produces an opinion rather than a verdict.

• C The coordinator's own system prompt, so the verifier shares its standards

The coordinator's system prompt conveys standing behavior, not the claim under test.

• D The full list of all findings, so this one can be ranked against the others

The other findings are irrelevant to whether this one is real.

Verification needs the specific assertion, where to look, the material to look at, and a defined bar for refutation. Skepticism without evidence produces an opinion; the other findings are irrelevant to whether this one is real.

A codebase audit was interrupted after 60 of 90 modules. Some files changed while it was stopped. What is the correct resumption strategy?

• A Restart the audit from module 1, to guarantee a consistent snapshot

Restarting throws away sixty modules of completed work.

• B Ask the model to recall its earlier findings and continue on from there

A new session has no memory of the earlier one, so recall produces invention rather than state.

• C Inject prior findings, re-analyze the changed modules, then continue

Correct. Restore state without repeating work: inject prior findings, re-analyze only the modules whose files changed, then continue.

• D Resume at module 61 and ignore everything that was already completed

Blindly continuing keeps findings that the changed files may have invalidated.

Accurate resumption means restoring state without repeating work: prior findings are injected rather than re-derived, and only the changed files are re-analyzed, since their earlier conclusions are now stale. Blindly continuing keeps invalid findings; restarting throws away 60 modules of work; relying on recall is not state restoration at all.

In the context of session resumption, what does context injection mean?

• A Adding the previous session's identifier so history can be looked up

A session identifier is a label, not the state itself.

• B Increasing the size of the context window for the resumed session

Window size is a model property and has nothing to do with restoring prior state.

• C Loading the project's own CLAUDE.md file at the start of every new session

Standing project files provide guidance rather than prior findings.

• D Re-supplying completed units, findings, and open questions into the prompt

Correct. A resumed session starts with no memory of the prior one, so context injection is the deliberate act of putting the recorded state back into the prompt.

A resumed session starts with no memory of the prior one. Context injection is the deliberate act of putting the recorded state back into the prompt. Standing project files provide guidance, not prior findings, and a session identifier is not itself state.

You are configuring an automated Claude Code review that runs on every pull request and feeds a dashboard. Which configuration is correct?

• A Grant full tool access so failures can be reproduced, and return a prose summary

Prose breaks the consumer, and full tool access grants far more than reviewing requires.

• B Use the default settings and parse the reviewer's markdown output downstream

Markdown parsed downstream breaks silently whenever the formatting shifts.

• C Load the project standards, grant read and search only, and emit structured JSON

Correct. A downstream-consumed review needs the project's own standards loaded, tool access restricted to reviewing, and machine-readable output.

• D Load the standards but permit edits, so the reviewer fixes what it finds

Edit access turns a review into an unrequested change to the code under review.

A downstream-consumed review needs three things: the project's own standards loaded so findings match house conventions, tool access restricted to what reviewing requires, and machine-readable output. Prose and markdown break the consumer, and edit access turns a review into an unrequested change.

What does adding <code>context: fork</code> to a Skill or slash command's frontmatter do?

• A It clears out the whole conversation before the command begins running

The conversation is inherited rather than cleared, which is what lets the command act on what was established.

• B It duplicates the command so that it can be run twice over in parallel

Forking runs the command once, in isolation, rather than duplicating it for parallel execution.

• C It runs the command in an isolated context that inherits the conversation

Correct. The command executes in its own subagent context, inheriting the conversation while its intermediate work stays isolated and only the result returns.

• D It copies the current conversation into a new session the user can switch to

Nothing is copied into a new session the user can visit; the fork is internal to the command's execution.

A forked command executes in its own subagent context. Its intermediate tool calls and file dumps stay there; only the result comes back. That is what prevents a noisy command from polluting the main session's state.

An MCP server fronts a 400-page internal wiki. Agents burn many exploratory tool calls searching it before answering. What is the correct server-side change?

• A Rewrite the search tool's description so as to encourage fewer calls

A reworded description cannot make unaddressable content addressable.

• B Expose the pages as resources, so content is addressed and attached directly

Correct. Exploratory call storms are the signature of content exposed only behind tools, and resources make it addressable so it can be attached directly.

• C Increase the result limit on the search tool that already exists

A bigger result set makes each call heavier while the searching continues.

• D Add further search tools, each one scoped to a single section of the wiki

More search tools multiply the menu without removing the hunt.

Exploratory call storms are the signature symptom of content exposed only behind tools. Resources make server content addressable, so it can be attached directly instead of hunted for. More tools or bigger result sets make each call heavier without removing the hunt.

A server exposes <code>search_issues</code> and <code>search_pull_requests</code>. The agent routinely calls the wrong one. What is the correct fix?

• A Add a system prompt instruction telling the model to be careful of the two

A system-prompt reminder does not travel with the tool and is easily lost.

• B Merge the two of them into a single tool with a type parameter

Merging removes capability rather than ambiguity, and the type parameter inherits the same confusion.

• C Remove one of the tools, so the choice cannot be made incorrectly

Deleting a tool removes a capability the team presumably needs.

• D Rewrite both descriptions to state purpose, format, and when not to use each

Correct. Misrouting between semantically similar tools is a description problem, resolved by stating each tool's purpose, format, and when not to use it.

Misrouting between semantically similar tools is a description problem. Descriptions that draw the boundary explicitly — including when not to use this one, and how it relates to the neighbor — are what the model routes on. Merging or deleting removes capability rather than ambiguity, and a system-prompt reminder does not travel with the tool.

Your team needs an MCP server available to everyone who checks out the repository, authenticating with a key each developer holds privately. What is the correct setup?

• A Add it at project scope, referencing the credential by environment variable

Correct. Project scope makes the server travel with the repository, and environment variable expansion keeps the shared config free of secrets.

• B Add it at project scope and commit the key too, so setup is a single step

Committing the key leaks it to every clone, fork, and mirror.

• C Add it at user scope on each machine and document that in the README

User scope keeps the configuration on one machine, so teammates get nothing from the clone.

• D Add it at local scope, so each developer's configuration stays isolated

Local scope is the most isolated of all and leaves the server undiscoverable to the team.

Project scope is what makes a server travel with the repository for the whole team. Environment variable expansion keeps the shared config free of secrets while letting each developer supply their own. User and local scope leave the server undiscoverable to teammates; committing the key leaks it.

An extraction pipeline invents plausible phone numbers for documents that contain none. Which combination best addresses this?

• A Increase max_tokens, so the model is under no pressure to guess

More room to write does not create a way to say the value is absent.

• B Lower the sampling temperature down to zero for every extraction request

Deterministic sampling produces the same invented number more consistently.

• C Make the field nullable, instruct it to return null, and show an example

Correct. Fabrication happens when the schema offers no way to report absence, so make it representable, state the rule, and demonstrate it.

• D Add post-processing that discards numbers which fail a format check

Post-filtering discards real values along with invented ones and does not stop the invention.

Fabrication happens when the schema offers no way to say "not present." The fix is to make absence representable, state the rule, and demonstrate it with an example that actually exercises the missing case. Temperature and token limits do not create a slot for absence, and post-filtering discards real values too.

A <code>payment_terms</code> enum lists NET_30, NET_60, and DUE_ON_RECEIPT, but some contracts state terms outside that set. What is the correct schema design?

• A Keep the enum, add an OTHER member, and capture the raw wording

Correct. The enum keeps downstream values clean, while an OTHER member plus captured raw text gives the model a truthful place for anything unlisted.

• B Keep the enum and have the model choose the closest available member

Forcing the closest match silently corrupts data with a term the contract never stated.

• C Add every term encountered so far as a new member of the enum

Chasing each new term keeps the enum permanently behind the documents.

• D Drop the enum entirely and accept free text for the field instead

Free text throws away the constraint that keeps downstream values clean.

The enum keeps downstream values clean; OTHER plus captured raw text gives the model a truthful place to put anything unlisted, and preserves the evidence for review. Forcing the closest match silently corrupts data, and free text throws away the constraint entirely.

You must explain how authentication works in an unfamiliar 3,000-file repository, and context is limited. What is the correct exploration sequence?

• A Use Bash to concatenate the repository and read it all in a single pass

Concatenating the repository is the largest possible context cost for the least targeted result.

• B Read the README and the package manifest, then answer from those two

Manifests describe dependencies and entry points, not how the code behaves.

• C Glob for the paths, Grep for key symbols, then Read only what is central

Correct. Narrow before reading: locate candidates by pattern, find the symbols that matter by content, and spend context only where the evidence points.

• D Read every file under the auth directory in full before concluding

Reading a whole directory exhausts context on files that may have nothing to do with the answer.

Systematic exploration narrows before it reads: locate candidate files by pattern, find the symbols that matter by content, and spend context only on the files the evidence points to. Reading whole directories or the whole repository exhausts context; manifests alone do not describe how the code behaves.

You need every file in the repository whose name matches <code>*.test.ts</code>. Which built-in tool is correct?

• A Grep, searching the file contents for the string ".test.ts"

Content search would match unrelated references to that string inside files.

• B Glob, matching against the filename pattern directly

Correct. Glob is the tool for locating files by name pattern.

• C Bash, running a find command across the repository

Shelling out to find duplicates a built-in with worse integration.

• D Read, opening each of the directories in turn

Read does not enumerate directories.

Glob is the tool for locating files by name pattern. Grep searches contents and would match unrelated references to the string; shelling out to find duplicates a built-in with worse integration; Read does not enumerate directories.

You are wiring Claude Code into a CI pipeline that must never block on a prompt and must fail rather than run away. Which invocation shape is correct?

• A Print mode with structured output, a turn limit, and a tool allow-list

Correct. Print mode with structured output, a turn limit, and a tool allow-list gives all three properties: no blocking, parseable output, and a hard ceiling.

• B Interactive mode with a generous timeout, so a human can step in

Interactive mode blocks on a prompt that nothing in CI will answer.

• C Print mode with every permission check bypassed, so nothing stalls

Bypassing every permission check removes the guard rails instead of the prompts.

• D Interactive mode with the output piped to a file for later inspection

Redirecting output does not stop an interactive session from waiting for input.

CI needs three properties: no prompt can block the run, the output can be parsed by the next step, and the run has a hard ceiling. Print mode with structured output, a turn limit, and a tool allow-list gives all three. Bypassing every permission check removes the guard rails instead of the prompts, and interactive mode blocks.

An analyst asks Claude to "look at this spreadsheet and tell me what's interesting." The reply is a long, unfocused list that misses the quarterly variance the analyst cared about. What is the most effective change to the request?

• A Add "be thorough and detailed" so nothing significant is left out

Thoroughness is the opposite of the fix. The answer was already too broad; this makes it longer without making it relevant.

• B Break the spreadsheet into smaller files and ask about each one separately

Splitting the data destroys the quarter-on-quarter comparison the analyst actually wanted.

• C Ask the same question again, since a second attempt often produces a different angle

A second attempt varies phrasing, not the criterion that was missing — the reply will be differently unfocused.

• D State the decision the analysis feeds, the comparison that matters, and the form the answer should take

Correct. The gap is a missing standard for relevance; naming the decision, the comparison and the format supplies exactly that.

"Interesting" is the analyst's judgement, not a property of the data, so the model has nothing to aim at. Naming the decision, the comparison and the output format supplies the missing criterion. Re-asking varies the output without steering it, splitting the file removes the cross-quarter comparison entirely, and asking for thoroughness makes an unfocused answer longer.

A team wants Claude to write customer replies in their established house voice. They have roughly forty past replies they consider good. What is the most effective use of those examples?

• A Supply the single best example and ask the model to match it exactly

One example teaches imitation of that specific reply, so the voice breaks as soon as the situation differs.

• B Summarize the voice in adjectives drawn from the examples and supply the adjectives instead

Adjectives are a lossy summary of a voice; the phrasing habits that make it recognisable do not survive the compression.

• C Paste all forty so the model has the fullest possible picture of the voice

Past the first few, additional examples add length and cost far faster than they add signal, and they push the actual instruction further from the model's attention.

• D Include three or four that differ from each other, covering the range of situations the voice has to cover

Correct. A few contrasting examples convey both the pattern and its range, which is what makes the voice transferable to a new situation.

A handful of deliberately varied examples teaches the pattern and its range at once, which is what makes the voice reproducible across situations. Forty examples add cost and crowd the instruction without adding much signal past the first few. Adjectives lose the very specifics that make a voice recognisable, and one example teaches the model to imitate that situation rather than the style.

A first draft is close but too formal for the intended audience. What is the most efficient next step?

• A Start a fresh conversation with a better prompt so as to avoid contaminating the final result

Starting over throws away a draft that was already close, and nothing about the existing conversation is harming the result.

• B Ask for a revision that names the specific quality to change and keeps everything else

Correct. Naming the one dimension to change protects everything that already works and avoids regressions elsewhere.

• C Rewrite the formal passages by hand, since the model has shown it cannot hit the register

One adjustable miss on a single dimension is not evidence the register is unreachable; it has not yet been asked for directly.

• D Ask for five separate variations and simply pick whichever of them happens to read the best

Five variations create a selection problem where a single named adjustment would do, and each variation risks losing what worked.

A targeted revision preserves the parts already working and moves only the dimension that is wrong, which is both faster and less likely to regress. Starting over discards a draft that was nearly right, generating variations spends effort producing options nobody asked for, and abandoning the tool after one adjustable miss is premature.

Claude produces a market summary containing a specific market-size figure attributed to a named research firm. The employee has not supplied any source documents. What should happen before the figure is used in a client deck?

• A Use it, since the attribution to a named firm indicates the figure was retrieved from that source

An attribution is generated text like any other. Naming a real firm makes a wrong figure more damaging, not more trustworthy.

• B Verify the figure against the firm's actual publication before it appears anywhere client-facing

Correct. Nothing was supplied to ground the number, so the only thing that establishes it is the original publication.

• C Ask the model to confirm that the figure is correct and then use it if the model does confirm it

Self-confirmation is not verification; the model has no independent access to the source and will generally agree.

• D Use it with a hedge such as "approximately", which covers any minor inaccuracy in the figure itself

"Approximately" addresses precision. The problem here is whether the figure exists at all, which a hedge does not touch.

With no source supplied, both the number and the attribution are generated rather than retrieved, and a named firm makes a fabricated figure more dangerous rather than less because it borrows unearned credibility. Only checking the firm's actual publication establishes the fact. Hedging language misstates the problem, which is provenance rather than precision, and asking the model to confirm its own output produces agreement, not verification.

A request asked for risks, mitigations and owners for each risk. The output lists risks and mitigations clearly but names no owners. What is the appropriate response?

• A Rewrite the request from scratch with the three parts numbered

Starting over discards two parts that were delivered correctly, to fix one that only needs to be requested.

• B Accept it, since owners can be added later by whoever files the document

Deferring the gap moves it to someone with less context about which owner belongs to which risk.

• C Accept it, because the substantive analysis was the risks and mitigations

The requester asked for owners, which makes them part of the deliverable regardless of which part feels most analytical.

• D Return it against the original three-part ask and request the missing element

Correct. The shortfall is specific and known, so naming it recovers the missing third without touching the working parts.

The ask had three parts and two were delivered, so the specific gap is known and easily closed by naming it. Accepting silently moves the work to a later reader who has less context, deciding unilaterally that the missing part was the unimportant one overrides the person who asked, and restarting discards two-thirds of a usable result.

A drafted apology to a customer whose order was lost is accurate and complete but reads as procedural. Which revision most improves it?

• A Add an exclamation mark and a warmer sign-off

Surface friendliness over unchanged procedural content usually reads as insincere rather than warm.

• B Add an apology sentence to each paragraph so regret is unmistakable

Repetition reads as anxiety rather than sincerity, and it displaces the remedy the customer actually wants.

• C Acknowledge the specific inconvenience caused and state what happens next, without hedging responsibility

Correct. Naming the specific inconvenience and the concrete next step is what distinguishes an apology from an acknowledgement.

• D Lengthen the message so the customer sees that the issue was taken seriously

Length signals effort spent, not care taken, and a longer procedural message is still procedural.

A procedural apology fails because it treats the customer's situation as a case rather than an inconvenience to a person. Naming the specific harm and the concrete next step addresses both. Punctuation and sign-offs are surface warmth over the same procedural content, length signals effort rather than care, and repeated apologies read as anxious without adding remedy.

Which output characteristic most strongly suggests a claim needs verification before use?

• A The claim carries specific detail that could not have come from anything supplied in the conversation

Correct. Detail with no possible source in the supplied material was produced rather than retrieved, which is exactly the case needing a check.

• B The claim is stated in confident, specific language

Confident, specific language is characteristic of correct answers as well, so it separates nothing.

• C The claim contradicts what the reader expected to find

A surprising claim may simply be true; surprise measures the reader's expectation, not the claim's grounding.

• D The claim appears near the end of a long response

Position in the response is unrelated to whether a claim is supported.

The reliable signal is provenance: a specific figure, date or citation that has no possible source in the supplied material was generated rather than retrieved. Confidence is a property of the prose and is present in correct answers too, surprise reflects the reader's prior rather than the claim's support, and position in the response carries no information about grounding.

A team repeatedly answers questions from the same twenty reference documents and wants consistent answers across colleagues. Which approach fits best?

• A Each person pastes the relevant document into a fresh conversation as needed

Per-conversation pasting makes each answer depend on what that individual chose to include, which is the inconsistency being complained about.

• B Each person keeps a personal conversation of their own and returns to it as needed

Separate private conversations drift apart over time, since nothing holds them to a common source or standard.

• C A shared Project holding the documents and the team's standing instructions

Correct. Shared documents plus shared instructions is exactly the pairing that produces consistent answers across a team.

• D One person answers all such questions and then forwards the results on to everyone

Routing through one person is a bottleneck and loses the point of giving the team the capability.

The requirements are shared source material and consistent answers, which is what a Project provides: one place for the documents and one place for the instructions everyone works from. Pasting per conversation makes each answer depend on what that person happened to include, funnelling through one colleague creates a bottleneck, and private conversations diverge over time precisely because nothing is shared.

A workflow classifies several thousand short support messages a day into one of six categories. Accuracy is good with the smallest capable model. What most sensibly drives model choice here?

• A Alternate between models to balance cost against quality

Alternating gives the same input different treatment depending on timing, which makes downstream behavior unpredictable.

• B Always use the most capable available model, since accuracy matters most

Capability beyond the accuracy bar is spend without benefit, and at several thousand messages a day it compounds quickly.

• C Choose based on which model has the largest context window

Context window governs how much text fits, which is not the constraint when classifying short messages.

• D Use the smallest model that meets the accuracy bar, and re-test when the task or the models change

Correct. Smallest-that-passes is the right default for a stable high-volume task, provided it is re-checked when things change.

For a high-volume, well-defined task the smallest model clearing the accuracy bar is the right default, with re-testing when circumstances change. Defaulting to maximum capability spends heavily for accuracy already achieved, alternating produces inconsistent behavior for no gain on short inputs, and context window is irrelevant when the inputs are short messages.

An employee wants a single answer drawn from a 900-page document set that exceeds the context window. What is the appropriate approach?

• A Ask the question repeatedly until an answer referencing the whole set appears

Repetition does not extend the context window; unseen pages stay unseen however often the question is asked.

• B Split the set arbitrarily and take the first answer that sounds complete

Sounding complete is a property of the prose, and arbitrary splits make it likely the decisive section was never read.

• C Paste as much as fits and accept that the answer covers that portion

Whatever fits is an arbitrary slice, and an answer drawn from it will look no different from one drawn from the whole.

• D Narrow to the sections that bear on the question, or summarize in stages and reason over the summaries

Correct. Either narrow the input deliberately or reduce it in stages — both keep the reasoning tied to the relevant material.

When material exceeds the window the work is selection or staged reduction: narrow to the relevant sections, or summarize in passes and reason over the summaries. Taking whatever fits silently answers from an arbitrary slice, repeated asking cannot conjure unseen text, and picking the first complete-sounding answer selects for fluency over coverage.

A monthly reporting process involves pulling figures from a dashboard, writing commentary, and circulating the result for sign-off. Which part is the strongest candidate to hand to Claude first?

• A The whole process end to end, so the benefit is realised at once

Automating the whole chain at once removes the human check on the figures, which is what was making the commentary safe to trust.

• B Pulling the figures, since it is the most repetitive step

Repetition is not the criterion; extracting figures is a systems-access task, and an error there propagates into everything downstream.

• C Drafting the commentary from figures that a person has already pulled and checked

Correct. Language work over already-verified inputs plays to the strength and keeps a person between the data and the narrative.

• D Circulating for sign-off, since it is purely administrative

Circulation is routing and approval, which workflow tooling handles more reliably than a language model.

Drafting commentary from verified figures is language work over an input a person has already validated, which is where the tool is strong and the risk is contained. Pulling figures is a systems-access problem, circulation is a routing task better handled by workflow tooling, and automating the whole chain at once removes the verification step that makes the drafting safe.

Four drafting tasks are being automated. Which most requires human review before the output leaves the organization?

• A An internal meeting agenda circulated to the team that requested it

An internal agenda going to the people who asked for it is corrected in seconds by its own audience.

• B A set of alternative subject lines for an internal newsletter

Subject-line options are choices for a person to pick from, so nothing reaches an audience unreviewed.

• C A response to a regulator quoting the organization's compliance position

Correct. It is external, binding, quotes a stated position, and is the hardest of the four to walk back.

• D A first-draft summary of a public webinar for internal reading

A first draft for internal reading is labeled as such, and errors surface as it is used.

Review effort should follow consequence, and a regulatory response is externally binding, quotes a position that must be accurate, and is expensive to retract. The other three are internal, low-consequence, or explicitly drafts, where an error is caught cheaply by the reader who receives it.

A prompt for weekly status summaries works well for the person who wrote it but produces uneven results for colleagues. What most likely explains the difference?

• A The prompt is too long for consistent processing

Length affects everyone's results equally and does not produce variance that tracks who is using the prompt.

• B Results vary randomly between users regardless of prompt

Variation between runs is real but does not explain a stable pattern where one user consistently gets good results.

• C Colleagues are using a different model

A model difference would degrade the author's results too, so it does not explain a split that follows the person.

• D The prompt relies on context the author holds implicitly and never states

Correct. The author fills the gaps from their own knowledge of the job; colleagues fill them differently or not at all.

A prompt that works for its author and nobody else almost always encodes unstated assumptions — which audience, which definition of "status", which level of detail. The author supplies those silently from their own knowledge of the job. Model differences would affect the author equally, length does not produce user-specific variance, and randomness does not explain a consistent split between one user and the rest.

A Project's knowledge has grown to include current policies, superseded drafts and unrelated reference material. Answers have become less reliable. What is the first correction?

• A Remove superseded and unrelated material so the knowledge holds only what should be drawn on

Correct. Anything in the knowledge is fair game for retrieval, so what should not be used should not be there.

• B Split the Project into one per document

A Project per document abandons the grouping that made shared knowledge useful in the first place.

• C Restate the question more precisely each time

A sharper question does not prevent a superseded policy being retrieved and presented as current.

• D Add an instruction telling the model to prefer the most recent documents

Asking the model to prefer recency works around the problem rather than removing it, and superseded drafts are often undated.

Superseded material is indistinguishable from current material once both are in the knowledge, so the fix is to remove what should not be drawn on. An instruction to prefer recent documents asks the model to work around a problem that removal eliminates, one Project per document destroys the point of grouping, and more precise questions do not stop an outdated policy being retrieved as though it were live.

An employee attaches a scanned PDF of a signed contract and asks for the payment terms. The answer is vague and partly wrong. What is the most likely cause?

• A The contract is too long to process in one pass

Length typically causes omission rather than positive error, and payment terms are usually a short, findable section.

• B The scan's text was not reliably extracted, so the model is working from incomplete input

Correct. A scan is an image; the model sees only what extraction recovered, and gaps there appear as vagueness and error.

• C The question was insufficiently specific

An imprecise question yields a broad answer, not a confidently wrong one about specific terms.

• D Contracts are inherently ambiguous and resist summarization

Contracts are drafted to be precise. Ambiguity in the answer is more likely to come from the input than the genre.

A scan is an image, and whatever text extraction recovers is what the model sees. Poor extraction produces exactly this signature — vague where the text was legible and wrong where it was not. Length would tend to produce omissions rather than errors, contracts are drafted for precision, and a vague question would produce a vague but not incorrect answer.

Which instruction belongs in a Project's standing configuration rather than in individual prompts?

• A The specific question being asked today

Today's question is the definition of task-specific and changes with every use.

• B The organization's house conventions on terminology, spelling and citation format

Correct. Conventions apply to every piece of work in the Project, which is what makes them worth stating once.

• C The deadline for the current piece of work

Deadlines change per task and, in any case, do not shape the output.

• D The name of the colleague who requested the task

The requester varies per task and rarely changes how the work should be written.

Standing configuration is for what holds across every task in the Project, which is exactly what house conventions are: the same terminology and citation format apply whatever the question. The other three change task by task and belong in the prompt that describes the task.

An HR employee wants help drafting a performance improvement plan and considers pasting the employee's full file, including medical notes. What is the appropriate handling?

• A Paste the full file, since more context produces a better plan

More context is not better when the surplus is a special category of data the task does not require.

• B Paste the file after removing the employee's name

A file this detailed remains identifiable without a name, so redaction of the name alone is not real de-identification.

• C Include only what the plan requires — the role expectations and documented performance gaps — and leave medical information out

Correct. Supply what the plan is built from and omit what it is not — the medical notes serve no purpose here.

• D Paste the file but instruct the model not to refer to medical details

The disclosure happens when the data is supplied. An instruction about how to use it does not reverse that.

Data minimisation means supplying what the task needs and no more. A performance plan is built from role expectations and documented gaps; medical information is both unnecessary and a category that carries specific handling obligations. Removing the name leaves a file that is readily re-identifiable, and an instruction not to refer to something does not undo having disclosed it.

A marketing team uses Claude to draft blog posts that are then edited and published under a staff member's byline. What does responsible practice most clearly require?

• A No disclosure at all, since the text was edited by a person before it was ever published anywhere, which makes it that person's own work in the end

Editing improves quality but does not by itself resolve what the audience or a regulator is entitled to be told.

• B Following whatever disclosure standard the organization and its industry have set, and ensuring a named person takes responsibility for the published claims

Correct. Apply the standard that actually governs the context, and make sure a person is accountable for what is published.

• C Disclosure only where the post makes factual claims

Restricting disclosure to factual posts is a self-made rule that may not match what applies.

• D A disclosure on every single post stating clearly that AI was involved somewhere in the drafting of it, whatever the post itself happens to say in the end

A universal rule ignores that requirements differ by sector and audience, and it may still leave accountability unassigned.

Disclosure norms vary by sector, audience and regulator, so the defensible position is to follow the applicable standard rather than invent one — and in every case a named person must own the published claims. A blanket rule either over- or under-discloses depending on context, editing alone does not settle attribution, and confining disclosure to factual posts substitutes the drafter's judgement for the standard.

A recruiter asks Claude to rank a shortlist of candidates from their CVs and recommend who to interview. What is the primary concern?

• A Ranking people for an employment decision delegates a consequential judgement to a system that cannot account for it and may reproduce patterns present in its inputs

Correct. The decision is consequential and regulated, needs examinable reasons, and can silently carry forward patterns in the inputs.

• B Candidates may object to having their CVs processed by software rather than considered by a person, which raises a consent question for the organization

Candidate expectations matter, but the substantive problem is the decision being delegated rather than the processing itself.

• C The model may summarize some CVs more thoroughly than others, so the shortlist reflects uneven treatment rather than a consistent standard of assessment

Uneven summarization is a symptom worth noticing; the primary issue is that a ranking is standing in for a reasoned judgement.

• D The model may take considerably longer to work through the CVs than a recruiter reading them directly would, which removes a good deal of the saving the exercise was meant to deliver

Speed is not the concern; a fast unaccountable decision is worse than a slow one, not better.

The issue is the nature of the decision, not the speed of it. Employment decisions affect people materially, attract regulatory scrutiny, and demand reasons that can be examined — none of which a ranking produced from CV text can supply, and any patterns in the material can be reproduced without being visible. Processing speed, candidate sentiment and uneven summarization are real but secondary to delegating the judgement itself.

A prompt that produced good summaries for months now yields shallow ones. Nothing about the prompt changed. What is the most productive first check?

• A Assume that the model's behavior has changed and simply rewrite the whole prompt accordingly here

Rewriting before knowing the cause risks fixing the wrong thing and losing a prompt that may still be correct.

• B Compare a recent input against an older one, since the documents being summarized may have changed in kind

Correct. With the prompt constant, the input is what most plausibly changed, and comparing examples shows it immediately.

• C Move the work to a more capable model

A more capable model may paper over a change in the inputs that is worth understanding on its own terms.

• D Increase the requested output length, so that the summaries come back a good deal fuller than before

A longer output makes a shallow summary longer rather than deeper.

When the prompt is unchanged, the input is the variable most likely to have moved: documents that grew longer, changed format, or became more heterogeneous will produce shallower summaries from the same instruction. Rewriting, lengthening output or upgrading the model are all interventions applied before the cause is known, and each can mask the real change rather than fix it.

A compliance review must check each of 300 contracts against the same twelve clauses and produce one consolidated exceptions report. Reviews are nightly and completeness matters more than latency. Which structure is most appropriate?

• A Parallel workers each appending directly to the shared exceptions report

Direct appends give no opportunity to reconcile, so the same clause failure appears several times in different words.

• B A single agent looping over all 300 contracts in one session

300 contracts will not fit one context, and quality degrades well before the limit as earlier material is crowded out.

• C Parallel workers over contract subsets, with a coordinator that consolidates and de-duplicates exceptions

Correct. Independent work parallelises, and the consolidation step is what a coordinator exists to do.

• D A sequential pipeline passing each contract's findings into the next contract's review

Sequencing implies a dependency that does not exist here, and it serializes work that could run concurrently.

The contracts are independent, so there is nothing for sequencing to exploit, and 300 of them will exhaust a single context. Parallel workers give coverage; the coordinator is what turns 300 partial results into one report without duplicate or contradictory entries. Workers writing straight to a shared report produce exactly those inconsistencies with nothing to reconcile them.

An agent can call a tool that issues customer refunds. The business wants refunds under $50 to be automatic and anything larger approved by a human. Where does that rule belong?

• A In the tool's description, so the model knows not to exceed the limit

A description is text sent to the model like any other, so it constrains no more strongly than an instruction does.

• B Enforced in the refund tool itself, which refuses amounts above the threshold without an approval token

Correct. The tool enforces the threshold deterministically, so the limit holds regardless of what the model concludes.

• C In a post-hoc review that reverses any over-threshold refund the next day

After-the-fact reversal concedes that money already moved, which is precisely what the threshold exists to prevent.

• D In the system prompt, as an instruction the model must follow

A system prompt is context the model weighs; an injected instruction or an unusual case can talk it out of a limit.

A money-moving limit is a control, and controls belong where they cannot be argued with. The tool holds the threshold and refuses without an approval token, so compliance does not depend on the model's judgement or on the prompt surviving injection. Prompt and description are both instructions the model weighs against other context, and reversing refunds after the fact means the control has already failed.

In a twelve-worker fan-out summarising regional reports, two workers fail after retries. What should a well-designed coordinator do?

• A Retry the two workers indefinitely until they succeed

Unbounded retries block the run indefinitely if the failure is permanent rather than transient.

• B Return the ten results, stating explicitly which two regions are missing

Correct. Partial coverage is useful when its boundaries are explicit; that is what makes the degradation safe.

• C Silently drop the two regions and present the remainder as the result

This is the dangerous option: the output looks complete, so downstream consumers act as though two regions were checked.

• D Abort the run so no partial result is mistaken for a complete one

Aborting throws away ten valid results to avoid a problem that stating the gap already solves.

Reliability in a fan-out means degrading visibly. Ten twelfths of the coverage is worth having provided the gap is stated, so the consumer knows what the result does not cover. Aborting discards good work, unbounded retries stall the run behind a possibly permanent failure, and dropping silently converts partial coverage into a false claim of completeness — the only genuinely dangerous option.

A long-running agent's quality degrades over a session even though nothing exceeds the context limit. What is the most likely cause?

• A The model gets progressively less capable the longer a session runs

There is no fatigue mechanism; what changes across a session is the composition of the context, not the model.

• B Long sessions increase the probability of sampling errors

Sampling behavior does not degrade with session length; the input is what changed.

• C Context is processed more slowly as it grows, forcing shallower reasoning

Processing time and reasoning depth are not linked in the way this suggests.

• D Accumulated tool output and intermediate reasoning are crowding out the instructions and the current task

Correct. Relevant material becomes a shrinking fraction of the window, so it competes with accumulated noise.

Staying under the limit is not the same as using the window well. As transcripts, tool results and intermediate reasoning accumulate, the material that matters — the instructions and the current subtask — becomes a smaller share of what the model is attending to. The fix is curation: summarize or evict what is no longer needed. The other options describe mechanisms that do not exist.

A retrieval-backed assistant answers correctly when the right passage is retrieved but fabricates when it is not. Which change most directly addresses the failure?

• A Lower the temperature so output is more deterministic

Temperature affects variability. A deterministic fabrication is still a fabrication.

• B Use a more capable model, which fabricates less

A better model fabricates less often, which is a smaller version of the same problem rather than a solution to it.

• C Instruct the model to answer only from the supplied passages and to say when they are insufficient, and verify it does

Correct. The gap is that absent evidence is not treated as a stopping condition; making abstention explicit and testing it is the fix.

• D Increase the number of passages retrieved so the right one is more likely to appear

More passages lower the frequency of the failure but leave the behavior unchanged when retrieval still misses.

The failure is behavioral: the model treats absent evidence as license to reconstruct. Making abstention an explicit, tested behavior addresses it directly. Retrieving more passages reduces how often the gap occurs without changing what happens when it does, a stronger model narrows the gap but does not close it, and temperature governs variability rather than whether the model requires grounding.

A pipeline classifies incoming tickets, then drafts responses for the subset needing a written reply. Which routing design is most defensible?

• A Use the most capable model for both stages for consistency

Consistency is not the goal; the two stages differ in difficulty, and paying top capability for classification is spend without return.

• B Use a small model for classification and a more capable one for drafting, with the classification accuracy monitored

Correct. Match capability to task difficulty, and monitor the cheap stage because its errors are silent and propagate.

• C Use a small model for both stages and escalate only on customer complaint

Escalating on complaint means the customer discovers the failure, which is the most expensive possible detection point.

• D Alternate models by time of day to balance cost and quality

Time of day has no relationship to task difficulty, and it makes identical inputs behave differently.

The stages have different difficulty profiles: classification into known categories is a narrow decision a small model handles well and cheaply, while drafting a customer-facing reply is open-ended and benefits from capability. Monitoring matters because a classification error silently routes work wrongly. Uniform maximum capability overpays for the easy stage, escalating on complaint uses customers as the test suite, and time-based alternation makes behavior depend on something irrelevant.

A tool returns a 4,000-row result set that the agent must reason over, but only a handful of rows are ever relevant. What is the best design change?

• A Add filtering and pagination parameters so the tool returns only what was asked for

Correct. Selection belongs where the data is, so the tool returns the relevant subset instead of everything.

• B Instruct the model to ignore irrelevant rows

The rows still occupy the context and compete for attention whether or not the model is told to ignore them.

• C Summarize the result set with a second model call before the agent sees it

An extra call adds latency and a lossy compression step to work around an interface problem that has a direct fix.

• D Truncate the result to the first fifty rows

First-fifty is arbitrary with respect to relevance and will often exclude exactly the rows that mattered.

A tool that cannot be asked a narrow question forces the caller to pay for breadth it does not need, in tokens and in attention. Filtering and pagination move the selection to where the data lives. An instruction to ignore rows still spends the context, truncation is an arbitrary cut that may drop the relevant rows, and a summarization call adds latency and a lossy step to compensate for an interface that could simply be better.

Two MCP servers each expose a tool named `search`, one over internal documents and one over the public web. Calls are being routed to the wrong one. What is the correct fix?

• A Instruct the model in the system prompt to prefer the internal server

A standing preference for one server produces the opposite error whenever the other is the appropriate one.

• B Remove one of the servers so the ambiguity cannot arise

Both capabilities are presumably wanted; discarding one solves the routing problem by removing a feature.

• C Give each tool a distinct name and a description stating exactly what it searches and when to prefer it

Correct. Selection is made from names and descriptions, so that is where the ambiguity has to be resolved.

• D Order the servers so the intended one is registered first

Registration order is not a selection criterion, so relying on it is relying on an implementation detail.

Routing is driven by names and descriptions, so two tools that look alike will be confused whatever else is done. Distinguishing them at the point of selection fixes the cause. Removing a server sacrifices a capability, a system-prompt preference is a blanket rule that will be wrong whenever the other server is the right choice, and registration order is not a documented selection criterion.

An agent updates records in a CRM. Occasionally a network timeout leaves the agent unsure whether its write succeeded. What design property most directly addresses this?

• A Idempotent writes keyed on a client-supplied identifier, so a retry cannot create a duplicate

Correct. A client-supplied key makes the retry recognisable as the same operation, so repetition is safe.

• B Retrying the write until a success response is received

Retrying a non-idempotent write is the mechanism that produces duplicates, not a defense against them.

• C Logging every attempt for reconciliation the next day

Reconciliation is after-the-fact repair; the record is wrong for everyone reading it in the meantime.

• D Reducing timeout duration so failures are detected sooner

A shorter timeout increases how often the outcome is unknown, making the underlying problem more common.

Ambiguous failures are unavoidable in distributed systems, so the write must be safe to repeat. A client-supplied key lets the server recognize a retry as the same operation. Retrying without idempotency is exactly what creates duplicates, next-day reconciliation cleans up damage after the CRM has already been wrong all day, and a shorter timeout makes ambiguous outcomes more frequent rather than fewer.

A team evaluates a summarization feature by having an engineer read ten outputs each release and judge them acceptable. What is the most significant weakness?

• A There is no fixed set of cases with agreed expectations, so results are not comparable between releases and regressions are invisible

Correct. Without fixed cases and agreed expectations, two releases are never measured against the same thing.

• B Ten samples is by any measure far too few for the judgement to be statistically meaningful in any useful sense of the word here

Sample size is a real limitation, but a larger ad-hoc sample judged fresh each time still cannot detect a regression.

• C Engineers are not qualified to judge summary quality, which is a matter for the people who read them

Engineers can judge summaries perfectly well; the problem is that the judgement is not anchored to anything stable.

• D The evaluation should be automated in order to save the engineering time it currently consumes

Automation is worth having, but an automated ad-hoc evaluation has the same defect more cheaply.

The purpose of an eval harness is comparability: the same cases, the same criteria, so a change in score means a change in the system. Ad-hoc samples judged fresh each time cannot support that, which is why regressions slip through. Sample size matters but is secondary to having a fixed set at all, engineer judgement is a reasonable signal, and automation is a means rather than the missing property.

After a prompt change, aggregate eval scores are unchanged but users report the assistant now refuses reasonable requests. What does this most likely indicate?

• A The eval set does not contain the cases where behavior changed, so the aggregate hides a real regression

Correct. The reports point at cases the set does not cover, and adding them makes the regression visible and testable.

• B Aggregate scores are the wrong metric and should be replaced with user reports

User reports are a valuable signal but lag and are unrepeatable; the fix is to extend the eval set, not abandon it.

• C The prompt change had no effect and the reports are coincidental

Coincidence is a weak explanation when reports follow a specific change and describe a specific behavior.

• D Users are mistaken, since the eval scores are the objective measure

An eval measures what it contains. Where users and the harness disagree, the harness's coverage is the thing in question.

A stable aggregate over a set that lacks the affected cases says nothing about those cases. The reports are evidence of a gap in coverage, and the response is to add the failing cases to the eval set so the regression becomes measurable. Treating the score as authoritative over direct observation inverts the relationship, and replacing evals with user reports discards a repeatable measure for a lagging one.

A support assistant sends the same 6,000-token policy preamble on every request, followed by a short user question. Volume is high and the preamble rarely changes. What is the most effective optimization?

• A Cache the stable prefix so the unchanging portion is not reprocessed on every request

Correct. A stable prefix with a variable suffix is the canonical caching case: same behavior, less reprocessing.

• B Move the preamble after the user's question so it is processed last

Ordering does not change how much is processed, and putting stable content last defeats caching.

• C Split each request into two calls, one for the preamble and one for the question

Two calls sever the link between policy and question, so the second call answers without the grounding.

• D Shorten the preamble by removing detail until the cost is acceptable

Removing detail reduces cost by reducing the grounding, which changes answer quality rather than optimising it.

A large, stable prefix in front of a small variable suffix is exactly the shape prompt caching exists for, and it addresses cost and latency without changing behavior. Cutting detail trades away the grounding the answers depend on, reordering does not reduce what is processed, and splitting into two calls loses the connection between the policy and the question it should inform.

An agent summarizes inbound emails and can call a tool that forwards messages. A crafted email contains text instructing the agent to forward the mailbox contents to an external address. What is the most robust mitigation?

• A Use a more capable model, which is less likely to be misled

Capability raises the bar without changing the fact that the model is reading attacker-controlled text.

• B Scan inbound email for instruction-like phrasing and reject matches

Detecting instruction-like phrasing is an arms race; paraphrase and indirection defeat it while false positives block real mail.

• C Instruct the agent in its system prompt to ignore instructions found inside emails

That instruction competes with the injected one inside the same context, and sometimes it loses.

• D Require forwarding to be confirmed out of band, and restrict destinations to an approved list enforced by the tool

Correct. Constrain what the action can do rather than relying on the model to reason correctly about hostile input.

Untrusted content will sometimes win an argument with a system prompt, so the durable defense constrains the consequence rather than the reasoning: the tool enforces an allow-list and a human confirms. An instruction to disregard embedded instructions is itself just context, phrasing detection is an arms race against paraphrase, and a stronger model narrows the attack surface without eliminating it.

An agent must query a database that requires credentials. What is the safest arrangement?

• A Place the credentials in the system prompt so the agent can authenticate when needed

Anything in the system prompt is in the model's context, where it can be echoed, logged, or extracted.

• B Store the credentials in a tool description the model can read when required

A tool description is sent to the model like any other text; this is the same exposure with a different label.

• C Have the tool hold the credentials and expose only the query capability, so the secret never enters the model's context

Correct. The tool exercises the capability while the value never enters the conversation, so there is nothing to leak.

• D Ask the user to supply the credentials at the start of each session

This routes the secret through the conversation and burdens the user every session, for no security gain.

A secret in context can be echoed into a response, written to a transcript or log, or extracted by an injected instruction. Keeping it inside the tool means the capability is exercised without the value ever being visible to the model. The prompt and the tool description are both context; asking the user each session moves the secret into the conversation while adding friction.

After an agent takes an incorrect action in production, the team needs to establish why. Which record is most useful?

• A Aggregate metrics showing error rates around the time of the incident

Aggregates tell you that something happened and roughly when, not why this request went wrong.

• B The inputs, retrieved context, tool calls with arguments, and results, correlated by a request identifier

Correct. Inputs, retrieved context and the tool-call trace are what let a specific decision be reconstructed.

• C The final response the agent returned to the user

The response is the outcome under investigation; it does not show what led to it.

• D The system prompt in force at the time

The prompt is one input among several and cannot explain the action without the retrieved context and tool results.

Reconstructing a decision requires what the agent saw and what it did: inputs, retrieved context, the tool calls and their arguments and results, tied together so one request can be followed end to end. The final response is the symptom, aggregate metrics locate an incident without explaining it, and the system prompt is necessary but far from sufficient on its own.

A stakeholder asks for an agent that will "handle all customer emails automatically." What is the most productive first response?

• A Decline, since fully automatic handling of every customer email is not an achievable goal

A useful version of this is achievable; refusing the whole request discards it along with the unrealistic framing.

• B Agree and begin the work straight away, refining the scope as issues emerge over the course of the build itself as they arise

Refining scope as issues emerge means discovering the disagreement after the build, which is the expensive moment to find it.

• C Establish which categories can be handled end to end, which need review, and which must escalate — and set the accuracy bar for each

Correct. Partitioning by category and agreeing a bar for each turns an unbounded ask into something that can be delivered and judged.

• D Propose a smaller pilot first, without changing the eventual goal that was described

A pilot is sensible, but without a partitioned scope it just reaches the same ambiguity later.

"All" hides a distribution: some categories are safely automatable, some need review, and some must reach a person. Partitioning the work and agreeing an accuracy bar per category converts an unbounded ask into a deliverable and sets expectations before anything is built. Starting without that defers the disagreement, refusing rejects a workable version of the request, and a pilot with the same undefined goal postpones the same conversation.

An agentic system is being handed to an operations team who did not build it. Which artifact matters most for their ability to run it?

• A The full prompt history from development

Prompt history documents how the system was arrived at, which is rarely what an operator needs.

• B Benchmark results from the final evaluation run

A benchmark is a snapshot of one moment and says nothing about behavior under failure.

• C A diagram of the agent's internal orchestration

A diagram supports understanding but does not tell the on-call engineer what to do when something breaks.

• D The failure modes with their symptoms, the checks that detect them, and what to do about each

Correct. Symptoms, detection and response is precisely the knowledge that transfers operational capability.

An operations team's job is recognising and responding to failure, so the artifact that carries the most weight is a runbook of failure modes, detection and response. Architecture diagrams help them build a mental model, prompt history is development archaeology, and a final benchmark describes one moment rather than telling them what to do at 3am.

A prompt change is expected to improve one category of request but might affect others. The system is live. What is the most appropriate rollout?

• A Deploy behind a flag that a person can toggle if complaints arrive

A flag is a good rollback mechanism but complaints are a slow, lossy detector for a category-level regression.

• B Deploy to everyone, monitoring aggregate quality metrics

An aggregate can stay flat while one category degrades and another improves, which is exactly the risk described.

• C Run the change against the eval set, then roll out to a slice of traffic with per-category metrics before going wider

Correct. Eval first for known cases, then a slice with per-category metrics for the ones the eval set does not cover.

• D Deploy during a low-traffic window so fewer users are exposed

Fewer users exposed is not the same as noticing the problem; detection is unchanged.

The stated risk is category-specific, so detection has to be category-specific too: the eval set catches known regressions before any user sees them, and a traffic slice with per-category metrics catches what the eval set does not cover. An aggregate metric can hide a regression in one category behind an improvement in another, a quiet window reduces exposure without improving detection, and waiting for complaints uses users as the detector.

A team wants an agentic coding assistant to follow their conventions — test framework, directory layout, review expectations — without restating them in every session. What is the appropriate mechanism?

• A Reviewing the assistant's output against the conventions after the fact

Post-hoc review finds violations after the work exists, which is the expensive point to correct them.

• B Project-level configuration committed to the repository, so the conventions load with the codebase

Correct. Committed configuration versions with the code, applies to everyone, and cannot be forgotten.

• C A shared document that each developer pastes at the start of a session

Pasting depends on memory and discipline, and it drifts as the document and the codebase diverge.

• D A team norm that developers describe the conventions when they matter

Relying on people to notice when a convention is relevant fails in exactly the cases where they do not.

Conventions belong with the code they govern: committed to the repository, they version with it, apply to everyone automatically, and cannot be forgotten. Pasting depends on each developer remembering, a norm to mention conventions when they matter fails precisely when someone does not realise they matter, and post-hoc review catches violations after the work is done.

Six months after a successful pilot, adoption across the wider organization has stalled. Usage data shows most people tried the tool once and did not return. What is the most useful first investigation?

• A Find out what those first sessions were used for and where they fell short, since single-use suggests the first attempt failed to deliver

Correct. Single-use is a signal about first experience, so the question is what was attempted and how it fell short.

• B Run additional training sessions covering the same material again, on the basis that people simply did not absorb it properly the first time round

More training assumes people did not understand, which is one hypothesis among several and not yet the evidenced one.

• C Add capabilities, since the tool is evidently not powerful enough to hold anybody's interest beyond a single use

Adding capability assumes the tool was insufficient, which the data does not show — most people barely used it.

• D Mandate use so that people build the habit, which is what turns a trial into an established practice

A mandate produces compliance rather than adoption and leaves the original obstacle in place.

A try-once-and-stop pattern points at a first-use failure, and the diagnostic question is what people attempted and what they got. Repeating training assumes the problem was comprehension, adding capabilities assumes the tool was too weak, and mandating use forces the behavior without addressing why it did not happen — all three commit to a cause before it has been established.

A task extracts a title from a PDF, looks it up in a catalog, and writes a row to a database. The steps never vary. Should this be a workflow or an agent?

• A An agent, since any task of several distinct steps benefits from model-driven control

Step count is not what calls for an agent — a three-step task with a fixed order is a workflow. What would justify an agent is a path that cannot be specified in advance.

• B An agent, since the task reaches an external database that code alone cannot manage

Touching an external system says nothing about who controls the flow; code calls databases routinely, and a tool call does not require model-driven sequencing.

• C A workflow, since the steps are known in advance and code can orchestrate them

Correct. Every step and its order are known before the task starts, so code can sequence them and the model is called only where language understanding is actually needed.

• D A workflow, but only where end-to-end latency turns out to be a concern

Latency does not decide the shape here. The steps never vary, which makes it a workflow whether it runs in a second or an hour.

Agents earn their cost when the path cannot be specified up front. Here every step and its order are known, so code-controlled orchestration is cheaper, faster, and far easier to debug. Reaching for an agent adds model-driven nondeterminism to a problem that has none.

Which statement correctly distinguishes the SDK Tool Runner from the Claude Agent SDK?

• A The Tool Runner hosts your agent, while the Claude Agent SDK requires you to host it

Neither one hosts your agent — both leave deployment to you, which is exactly what makes them easy to confuse.

• B They are two names for the same helper, offered under different branding

They are separate packages with different scope, not one helper under two names.

• C The Tool Runner ships in the API SDK over tools you define; the Agent SDK is separate

Correct. The Tool Runner is reached through the regular API client and loops over tools you supply; the Agent SDK is a separate package shipping the Claude Code harness.

• D The Claude Agent SDK is Python only, while the Tool Runner is TypeScript only

Both are available across the supported languages; language is not what separates them.

They are different packages with different scope. The Tool Runner automates the request-execute-loop cycle for tools you supply and ships nothing built in; the Claude Agent SDK is Claude Code as a library, with built-in tools, subagents, and permissions. Both leave hosting to you.

An agent's context fills with large tool results from earlier steps that are no longer relevant. Which technique removes them without summarizing?

• A Lowering the effort level, so less of the old material is reconsidered

Effort tunes reasoning depth. It does not decide what material is present in the request.

• B Context editing, which clears the old tool results before the model sees them

Correct. Context editing clears the stale tool results outright, before the model sees them, which is removal rather than compression.

• C Compaction, which condenses all of the earlier history into a shorter summary

Compaction is the summarizing mechanism — it condenses rather than removes, which is not what was asked for.

• D Prompt caching, which stops the stale results from being billed again

Caching changes what gets re-billed on a repeated prefix; the results still occupy the context.

Clearing and summarizing are different operations: context editing removes stale tool results outright, while compaction replaces history with a summary. Caching affects cost on repeated prefixes rather than context size, and effort governs reasoning depth.

A stakeholder says the assistant must answer "instantly." What is the right next step?

• A Enable streaming, which makes almost any response feel instant to the end user

Streaming improves how fast a response feels, but it does not satisfy a goal nobody has quantified.

• B Choose the fastest model available and proceed on that basis

Picking a model before the target is known means nobody can say afterwards whether the requirement was met.

• C Reduce max_tokens until the responses come back fast enough

Cutting the output cap trades correctness for speed without anyone deciding that trade was acceptable.

• D Turn it into a measurable target latency at a stated percentile, and confirm it

Correct. A percentile latency target is implementable and testable, and it makes the tradeoffs against quality and cost explicit.

"Instantly" is not implementable as stated. Converting it into a percentile latency target makes the tradeoffs explicit and testable. Streaming improves perceived responsiveness but does not by itself satisfy an unquantified goal, and capping output trades correctness for speed without anyone deciding to.

Where do evaluations belong in the life cycle of a Claude-powered feature?

• A Continuously: built during development, run in CI, and monitored in production

Correct. Prompts and models both drift, so evaluation is an ongoing control rather than a one-time checkpoint.

• B Only before the first release, where they act as an acceptance gate

A release gate misses everything that changes afterwards — prompt edits, model upgrades, and shifting inputs all move behavior post-launch.

• C Only when changing models, since that is when the behavior actually shifts most

Model changes are one source of drift among several; prompt edits and input shifts move behavior just as much.

• D Only when a defect is reported by a user or by the operations team

Waiting for a report means users find the regressions, which is the outcome evaluation exists to prevent.

Prompt edits, model upgrades, and shifting input distributions all change behavior after launch, so evaluation is an ongoing control rather than a one-time gate. Treating it as a release checkpoint leaves regressions to be discovered by users.

A developer must process 10,000 documents overnight for a report needed the next morning, and cost is the main concern. Which approach fits?

• A Lower max_tokens on the synchronous calls so each one costs less to run

Capping output attacks quality rather than the realtime-versus-batch tradeoff that is actually driving the cost.

• B Use the Message Batches API, which handles the workload at a reduced cost

Correct. The workload is latency-tolerant and high-volume, which is the batch profile, and batching is priced well below synchronous calls.

• C Switch to the smallest model available, regardless of the output quality

Downgrading the model trades the report's quality for a saving that batching provides without that cost.

• D Send every request synchronously in parallel, to finish as quickly as possible

Parallel synchronous requests finish sooner but cost exactly the same per token, and cost is the stated concern.

The workload is latency-tolerant and high-volume, which is exactly the batch profile, and batching is priced below synchronous calls. Parallel synchronous requests finish sooner but cost the same per token; capping output or downgrading the model attacks quality rather than the realtime-versus-batch tradeoff.

Which HTTP status class should an integration treat as retryable with backoff?

• A The 4xx client errors generally, since the server may recover

Most 4xx responses mean the request itself was malformed or unauthorized, so an identical retry fails identically.

• B The 429 and 5xx responses, together with connection errors

Correct. Rate limiting, server-side faults, and network errors are all transient, which is what makes bounded retry with backoff appropriate.

• C Only a 500, which is the sole genuinely transient condition

A 500 is retryable, but so are 429, 502, 503, and dropped connections — this is too narrow to be useful.

• D Any non-200 response, since none of them returned a result

Blanket retrying burns quota on requests that can never succeed and delays surfacing a real bug.

Rate limiting and server-side failures are transient, as are network faults, so they warrant bounded retry with backoff. Most 4xx responses indicate a malformed or unauthorized request that will fail identically no matter how many times it is sent.

The same task is exposed through a web app calling the API and through Claude Code for internal users. What must the design account for?

• A Claude Code cannot perform the tasks that the API is able to perform

Claude Code is not less capable — it is differently configured, with its own tools and standing instructions.

• B Nothing, since instructions behave identically across every interface

The same text lands differently depending on what already surrounds it, so assuming parity is the mistake being tested.

• C Each interface brings its own surrounding instructions and tool set

Correct. Each interface supplies its own system instructions, tool set, and project configuration, so guidance written for one may be redundant, ignored, or contradictory in the other.

• D The API requires prompts to be shorter than the other interface does

Neither interface imposes a shorter prompt requirement; the difference is context, not length.

Interfaces differ in what already surrounds the prompt — system instructions, tool sets, and project configuration — so the same text lands differently. Designing for both means deciding what belongs in shared prompt content and what is interface-specific.

Why pin an explicit model identifier rather than relying on a default?

• A Pinned models are billed at a lower rate than defaults are

Pricing follows the model itself, not whether you named it explicitly.

• B It makes a model change an explicit decision with a test in front of it

Correct. Pinning converts an upgrade into a deliberate change that goes through evaluation and deploy, instead of behavior moving with no diff to point at.

• C Defaults always resolve to the smallest model available in the family

Defaults do not resolve to the smallest model, and relying on that assumption is itself a reason to pin.

• D Pinning is a requirement for prompt caching to work at all

Caching works regardless of how the model was selected.

Pinning converts an upgrade into a deliberate change that goes through evaluation and deploy. Floating means production behavior can move with no diff to point at.

Which mechanism should carry a convention that applies only to files under a specific directory?

• A The repository-root CLAUDE.md, which every session already loads

Root-level guidance applies everywhere, so a narrow rule would be imposed on unrelated work.

• B A rules file scoped to that directory, loading when those files are in play

Correct. Scoped rules attach guidance to the files it governs, so it applies automatically and stays out of work it does not concern.

• C A slash command that the developer always has to remember to run every time

A manual command depends on someone remembering it at the right moment.

• D A hook that fires whenever a file in that directory is touched

Hooks run on events and enforce actions; they are not how standing conventions are conveyed.

Scoped rules attach guidance to the files it governs, so it applies automatically and stays out of unrelated work. Root-level guidance applies everywhere, a manual command depends on someone remembering, and hooks run on events rather than supplying conventions.

A production feature returns HTTP 200 but users report the summaries are wrong. Where does the failure most likely lie?

• A In the network, which may be corrupting the response in transit

Network corruption would produce malformed responses or errors rather than coherent wrong summaries.

• B In the SDK's retry logic, which may be returning a stale attempt

Retry logic returns the response it received; it does not fabricate stale content.

• C In the integration layer, since a 200 means that the request was malformed

A 200 means the opposite — the request was well formed and was accepted.

• D In output quality, since the request succeeded and only the content is wrong

Correct. Transport and request construction both worked, so the defect is in what was generated rather than in how it was delivered.

A successful response separates the two failure classes: transport and request construction worked, so the problem is the content. Isolating integration-layer faults from output-quality faults is the first move in debugging these systems, because the remedies are unrelated.

Two runs of the same prompt with identical settings produce different wording. What explains this?

• A The requests were routed to servers holding different weights

All replicas serve the same weights for a given model; routing does not change the answer.

• B Generation samples from a distribution, so outputs vary

Correct. Generation samples from a distribution over next tokens, so identical inputs can legitimately yield different outputs.

• C A defect in the caching layer serving a stale response

Caching returns computation for an identical prefix; it does not invent different wording.

• D The model was updated in between the two calls being made

Weights are fixed between releases, and a pinned model does not change under you mid-session.

Sampling makes variation the normal case rather than a fault, which is why systems that depend on exact reproducibility need validation or constrained output rather than an assumption of stability.

What is the relationship between an official Claude SDK and the REST API?

• A The SDK supports features that are unavailable over plain REST

Capabilities are the same, since the SDK is calling the very same endpoints.

• B The SDK requires a separate API key from the REST interface

The same credentials work for both; no separate key is issued for SDK use.

• C The SDK uses a different protocol, optimized for its language

The SDKs speak the same HTTP protocol; there is no language-specific wire format.

• D The SDK is a typed wrapper over the same HTTP endpoints

Correct. The SDKs wrap the same endpoints and add ergonomics — retry policy, streaming helpers, typed exceptions — which is why raw HTTP remains valid.

The SDKs wrap the same endpoints, which is why raw HTTP remains a valid integration path. What they add is ergonomics and reliability behavior — retry policy, streaming helpers, typed exceptions — not different capabilities.

A high-volume classification step runs on every inbound message and must be cheap and fast. Which tier is the sensible starting point?

• A Alternate between the tiers in order to balance cost against quality

Alternating tiers makes behavior inconsistent and the results hard to interpret.

• B Whichever model the rest of the application already happens to use

Uniformity is a convenience; it does not make the tier appropriate for this step.

• C The most capable model, downgrading only if cost becomes a problem

Starting at the top pays a premium on every request while you wait for a cost problem to appear.

• D The smallest and fastest tier, escalating only if quality proves short

Correct. Narrow, high-volume, well-specified work is where the small tier earns its place, and quality is a measurable question rather than an assumption.

Narrow, high-volume, well-specified work is where the small tier earns its place, and quality is a measurable question rather than an assumption. Starting at the top and waiting for a cost problem pays a premium on every request in the meantime.

What is context bloat, and why does it degrade quality rather than merely cost?

• A It disables prompt caching for the affected requests

Bloat does not disable caching — a stable prefix still caches, however much noise follows it.

• B It causes the API to reject any of the requests that carry it

Requests are only rejected when they exceed the window; bloat degrades quality well before that.

• C Accumulated low-value content dilutes the material that matters

Correct. Accumulated low-value content dilutes the material that matters, so the signal the model needs competes with stale tool output and superseded turns.

• D It is only a cost problem and never a quality problem

Cost is the visible half; the quality effect is what makes pruning worth doing on its own.

Beyond the bill, an oversized context buries the relevant material among the irrelevant, and the model's attention is finite. Pruning is therefore a quality intervention as much as a cost one.

Which instruction belongs in the system prompt rather than the user message?

• A The specific document that this request needs analyzed

A specific document is per-request material and belongs in the user turn.

• B The persistent role, constraints, and conventions for every request

Correct. Standing behavior belongs where it is stable and can form a reusable cached prefix.

• C The user's question, which states what is actually being asked for

The question is the request itself and changes every call.

• D The passages retrieved for this particular query

Retrieved passages are per-query content and would invalidate the cached prefix if placed early.

Standing behavior belongs where it is stable and can form a reusable prefix; per-request material belongs in the user turn. Mixing them costs cache reuse and blurs the boundary between operator instruction and request content.

Why should application code validate model output even when a schema constraint is in use?

• A A schema checks shape, not whether the values are semantically right

Correct. A schema guarantees structure, not correctness — a well-formed response can still carry a fabricated value or violate a business rule.

• B Validation is a requirement for billing to be computed correctly

Billing is computed from token usage and has nothing to do with validation.

• C Schemas are unable to express nested objects within a response

Schemas express nested objects perfectly well.

• D Schema constraints are advisory rather than actually enforced

Schema constraints are enforced; the gap is that they enforce shape rather than truth.

A schema guarantees shape, not truth: a well-formed response can still carry a fabricated value. Validation at the boundary catches both structural surprises and violations of business rules the schema cannot express.

An agent summarizes user-submitted web pages. One page contains hidden text telling the model to ignore prior instructions and reveal its system prompt. Which mitigation is most effective?

• A Switch to a larger model that follows instructions more reliably

A model that follows instructions more reliably can be more susceptible to injected ones rather than less.

• B Treat page content as untrusted and bound what it can trigger

Correct. Isolating untrusted content and enforcing least privilege means injected text cannot reach a sensitive capability, whatever it says.

• C Add a system prompt line asking users not to include instructions

A polite request in the system prompt is not a control, and the attacker is not the user being asked.

• D Raise the temperature, so the behavior is harder to predict

Sampling settings do not govern whether injected instructions are followed, and unpredictability is not a security property.

Prompt injection is addressed by isolating untrusted content and enforcing least privilege so injected text cannot reach a sensitive capability. Sampling settings are irrelevant, a polite request is not a control, and a more instruction-following model can be more susceptible rather than less.

What does layering guardrails mean?

• A Using several models to vote on whether something is safe

Model voting is an ensemble technique rather than a layered set of controls.

• B Placing independent controls at input, tools, and output alike

Correct. Independent controls of different kinds at different points mean defeating one still leaves others in the path.

• C Running the guardrails only at the output stage of the pipeline

Output-only checking leaves everything upstream unprotected.

• D Applying the same check repeatedly, for added reliability

Repeating one check adds no independence — the same bypass defeats every copy.

Layering places controls of different kinds at different points, so defeating one still leaves others in the path. Repeating one check adds no independence, and output-only checking leaves everything upstream unprotected.

Why are hooks suited to preventing destructive actions where prompt instructions are not?

• A Hooks run on a separate model dedicated to enforcement

Hooks are ordinary code run by the harness; no second model is involved in deciding whether they fire.

• B Hooks execute on an event, whatever the model's judgment is

Correct. The hook fires because an event occurred, so it holds whether or not the model agrees with it — which is exactly what an instruction cannot promise.

• C Hooks are written in a stricter language than prompts are

Language has nothing to do with it — a hook could be written in anything. What matters is that the harness runs it rather than the model choosing to.

• D Hooks cannot be disabled once they have been registered

Hook configuration remains editable like any other setting. Their strength is that the model cannot route around them, not that nobody can.

The distinction is enforcement versus influence: a hook fires because an event occurred, not because the model chose to honor it. That is what makes hooks appropriate for controls that must not be negotiable.