CCDV-F practice questions, answered and explained

Using Managed Agents, where do the model, system prompt, and tool definitions belong?

• A On each session, so that every run can be configured independently of others

Putting configuration on sessions defeats the versioning the surface exists to provide, and it makes every run a fresh definition.

• B On the persisted agent object, which sessions then reference by its stored ID

Correct. Configuration lives on the persisted, versioned agent, and each session pins to it by ID — create the agent once, start a session per run.

• C In the first user message of each session, where the model reads them directly

Instructions in a user message are conversation content, not configuration, and they would have to be repeated on every run.

• D In the environment definition, alongside the container and networking settings

The environment describes the container and its networking; it does not carry the model or the prompt.

The mandatory flow is agent once, session per run: configuration lives on the versioned agent object and sessions pin to it. Putting configuration on sessions defeats the persistence and versioning the surface exists to provide.

An agent needs to remember facts about a user across sessions that end and restart days apart. Which mechanism fits?

• A Prompt caching, since the cached prefix persists between separate sessions

The cache is a short-lived cost optimization on a repeated prefix, not a store that survives days between sessions.

• B A larger context window, which holds more of the history at one time

A window holds one request's material; it does nothing once the conversation has ended.

• C A memory mechanism that persists state outside the conversation itself

Correct. Cross-session recall needs durable storage outside the conversation, loaded back in when the next session starts.

• D Extended thinking, which lets the model reason over earlier sessions

Thinking is reasoning within a request and gives the model no access to anything from an earlier session.

Cross-session recall requires durable storage outside the conversation, since a new session starts with no history. Caching is a cost optimization on repeated prefixes with a short lifetime, and a bigger window does nothing once the conversation has ended.

What belongs in the operate-and-maintain phase of a Claude application specifically, as opposed to a conventional service?

• A Output-quality monitoring, since a wrong answer still returns a 200

Correct. The system can fail by producing plausible but wrong output while every request returns 200, so output quality needs its own signals.

• B Uptime monitoring and error rates, exactly as for any other service

Availability monitoring never sees the distinctive failure — a successful request carrying an unacceptable answer.

• C Nothing distinctive, since it is monitored like any other web service

There is something distinctive: conventional telemetry is blind to content, which is where this class of system fails.

• D Only cost tracking, since spend is the one genuinely new variable

Cost matters, but tracking spend says nothing about whether the answers are right.

The distinctive failure mode is a successful request with unacceptable content, which conventional availability and error-rate monitoring never sees. Quality signals — validation failures, human review outcomes, sampled scoring — are what surface it.

A developer must process 10,000 documents overnight for a report needed the next morning, and cost is the main concern. Which approach fits?

• A Lower max_tokens on the synchronous calls so each one costs less to run

Capping output attacks quality rather than the realtime-versus-batch tradeoff that is actually driving the cost.

• B Use the Message Batches API, which handles the workload at a reduced cost

Correct. The workload is latency-tolerant and high-volume, which is the batch profile, and batching is priced well below synchronous calls.

• C Switch to the smallest model available, regardless of the output quality

Downgrading the model trades the report's quality for a saving that batching provides without that cost.

• D Send every request synchronously in parallel, to finish as quickly as possible

Parallel synchronous requests finish sooner but cost exactly the same per token, and cost is the stated concern.

The workload is latency-tolerant and high-volume, which is exactly the batch profile, and batching is priced below synchronous calls. Parallel synchronous requests finish sooner but cost the same per token; capping output or downgrading the model attacks quality rather than the realtime-versus-batch tradeoff.

For a routine, well-specified subtask inside a larger agent, which effort setting is usually appropriate?

• A The highest available setting, since quality always matters

Spending maximum reasoning on mechanical work is the common cost mistake, and it buys little on a task with no ambiguity.

• B A low setting, saving deeper reasoning for the judgment steps

Correct. Matching effort to task difficulty — low for routine work, higher for synthesis and judgment — is what keeps an agent affordable.

• C Effort carries no cost implication, so the choice does not matter

Effort directly drives token spend, so the choice has a real cost implication.

• D Effort must match whatever the parent agent has been set to

Effort is set per call, and subagents routinely run at a different level from their parent.

Spending deep reasoning on mechanical subtasks is the common cost mistake. Matching effort to task difficulty — low for routine extraction, higher for synthesis and judgment — is what keeps an agent affordable.

Which task most clearly justifies the most capable model tier?

• A Planning and executing a refactor across an unfamiliar codebase

Correct. Open-ended, multi-step work requiring judgment under uncertainty is where capability differences show up most.

• B Reformatting JSON from one layout convention into another

Reformatting between conventions is mechanical and needs no frontier capability.

• C Detecting which language a short inbound message is written in

Language detection on a short string is a narrow task the smallest tier handles well.

• D Extracting a single date field from a structured form document

Single-field extraction from a structured form is similarly narrow.

Open-ended, multi-step work requiring judgment under uncertainty is where capability differences show up most. Language detection, single-field extraction, and reformatting are narrow tasks the smaller tiers handle well at a fraction of the cost.

Where should untrusted user input be placed within a prompt?

• A Merged into the system prompt, so the model treats it as authoritative

The system prompt carries operator authority, so putting user text there is the injection risk itself.

• B At the very end of the system prompt, after the instructions

Position within the system prompt does not change the authority the text inherits.

• C Split across both the system and the user content of the request

Splitting it across both blurs the boundary in the same way while making the prompt harder to reason about.

• D In a clearly delimited region of the user content, kept separate

Correct. A marked region of user content preserves the boundary between what the operator instructed and what someone supplied.

Keeping untrusted text inside a marked region of user content preserves the boundary between what the operator instructed and what someone supplied. Anything that places it in the system prompt grants it instruction authority.

An agent summarizes user-submitted web pages. One page contains hidden text telling the model to ignore prior instructions and reveal its system prompt. Which mitigation is most effective?

• A Switch to a larger model that follows instructions more reliably

A model that follows instructions more reliably can be more susceptible to injected ones rather than less.

• B Treat page content as untrusted and bound what it can trigger

Correct. Isolating untrusted content and enforcing least privilege means injected text cannot reach a sensitive capability, whatever it says.

• C Add a system prompt line asking users not to include instructions

A polite request in the system prompt is not a control, and the attacker is not the user being asked.

• D Raise the temperature, so the behavior is harder to predict

Sampling settings do not govern whether injected instructions are followed, and unpredictability is not a security property.

Prompt injection is addressed by isolating untrusted content and enforcing least privilege so injected text cannot reach a sensitive capability. Sampling settings are irrelevant, a polite request is not a control, and a more instruction-following model can be more susceptible rather than less.

A tool set has grown to forty tools and selection accuracy has fallen. What is the most effective remedy?

• A Rename the tools with numeric prefixes to impose an ordering

Ordering is not what the model routes on.

• B Increase the model tier to one that selects more accurately

A larger model helps at the margin but leaves the same overloaded menu in place.

• C Combine all forty of them into one tool with a mode parameter

A single mega-tool moves the same ambiguity into a parameter the description cannot document as clearly.

• D Reduce the set each agent sees, and sharpen the descriptions

Correct. Selection degrades as the menu grows and as boundaries blur, so trimming per role and clarifying boundaries both address the cause.

Selection accuracy degrades as the menu grows and as boundaries blur, so trimming per role and clarifying boundaries both help. A single mega-tool moves the same ambiguity into a parameter, and ordering is not what the model routes on.

A capability is needed by one application only, involves proprietary logic, and is unlikely to be reused. Which approach fits?

• A A built-in tool, which needs no implementation of your own

A built-in tool cannot contain your proprietary logic.

• B A Skill packaging the procedure as written instructions

A Skill packages know-how; it cannot supply proprietary logic the agent has no way to execute.

• C A custom tool defined directly within that one application

Correct. A single-consumer capability does not need the indirection an MCP server provides, and a custom tool is simpler to build and deploy.

• D An MCP server, for consistency with the other integrations

Consistency is a weak reason to take on a separate deployable that nothing else will use.

A single-consumer capability does not need the indirection an MCP server provides; a custom tool in the application is simpler to build and deploy. MCP earns its overhead when several clients share the integration.

What most clearly distinguishes an agent from a workflow that happens to call tools?

• A The agent keeps conversation state, while the workflow is stateless

Statefulness varies freely on both sides; plenty of workflows carry state across steps and plenty of agents are single-turn.

• B The agent uses more tools than the workflow does over the course of a task

A workflow may call a dozen tools and an agent may call one; the count says nothing about who chose them.

• C The agent runs on a larger model, while a workflow can use a smaller one

Both shapes run on whatever model you configure, and a workflow on a large model is still a workflow.

• D The model decides which tool to call next and when the task is finished

Correct. Authority over control flow is the dividing line — in an agent the model picks the next step and the stopping point, in a workflow your code does.

Authority over control flow is the dividing line: in an agent the model chooses the next step and the stopping point, in a workflow your code does. Tool count, model tier, and statefulness all vary freely on either side of that line.

Why capture the cost of a wrong answer during requirements, rather than during testing?

• A It decides the evaluation metric, which must be chosen before any data is collected

Metrics can be chosen after data is collected, and they are refined as understanding improves.

• B It sets the token budget, which cannot be adjusted once the system is built

Token budgets are tunable throughout the life of the system.

• C It selects the model tier, which is fixed for the lifetime of the application

Model tier is one of the easier things to change later, and it is revisited routinely.

• D It determines the review and rollback design, which shapes the whole architecture

Correct. Whether a mistake is cheap or catastrophic decides whether a human sits in the loop, and retrofitting that gate late means rebuilding around it.

Whether a mistake is cheap or catastrophic decides whether a human sits in the loop, and retrofitting that gate late means rebuilding around it. Token budgets, model tiers, and metrics are all revisable later at far lower cost.

What distinguishes a skill from a tool?

• A A skill packages instructions and know-how; a tool performs an action

Correct. Skills supply procedure — how to approach something with capabilities that already exist — while tools add capability the model would otherwise lack.

• B A skill has a schema for its inputs, while a tool takes free-form text

Tools carry the input schema, so this has the two reversed.

• C A skill is invoked by the harness, while a tool is invoked by the model

Both are model-invoked; neither is fired by the harness.

• D A skill runs on the server, while a tool runs on the client machine

Both run in the same place; execution location is not the distinction.

Skills supply procedure — how to approach something using capabilities that already exist — while tools add capability the model would otherwise lack. Both are model-invoked, and the schema and execution-location claims describe neither accurately.

A response occasionally contains what looks like a tool call written as plain text, and the tool never runs. Which configuration most likely explains it?

• A Thinking is disabled, which can push a call into the visible response

Correct. With thinking turned off the model sometimes writes the call into visible text — the turn succeeds, nothing executes, and no error is raised.

• B Parallel tool use is enabled, so some calls are emitted as text instead

Parallel tool use emits multiple proper tool_use blocks, not text imitations of them.

• C Streaming is enabled, so tool blocks are split across separate events

Streaming splits blocks across events but reassembles into proper tool_use blocks.

• D The effort level is set too high for the number of tools provided

Effort tunes reasoning depth and does not cause calls to be rendered as prose.

With thinking turned off, the model sometimes writes the call into visible text — the turn succeeds, nothing executes, and no error is raised. Turning thinking on and lowering effort addresses it; parallel calls, effort alone, and streaming do not produce this failure.

Why does the deferred-loading mechanism for tools require at least one non-deferred tool?

• A Deferred tools cannot be described without a loaded tool to compare against

Descriptions do not need a loaded peer for comparison; that is not how deferral works.

• B With everything deferred there is no tool available to perform the search

Correct. The search tool itself has to be loaded for anything to be discoverable, so deferring every tool is rejected outright.

• C The first tool in the list is always used as the schema for the others

No tool acts as a schema for the others.

• D Deferred tools are billed only when a non-deferred tool is also present

Billing is unrelated to the requirement, which is about discoverability.

The search tool itself has to be loaded for anything to be discoverable, so deferring every tool is rejected outright. Descriptions, schemas, and billing are unrelated to the requirement.

What is the core claim of context engineering, as distinct from prompt engineering?

• A Context should be filled to capacity so the model has the most to work with

Filling the window indiscriminately is the anti-pattern this discipline exists to correct.

• B What occupies the window, and in what order, is itself a design decision

Correct. Selecting and arranging what the model sees is the design work, distinct from wording the instruction well.

• C Longer prompts produce better results when the window allows for them

More content is not automatically better; it adds cost and dilutes what matters.

• D Prompts should be written once and then left unchanged across versions

Prompts are revised continually as models and requirements change.

Selecting and arranging what the model sees is the design work, and more content is not automatically better. Filling the window indiscriminately adds cost and dilutes the material that actually matters.

A single MCP server exposes sixty tools, and the agent's tool selection has become unreliable. What is the most direct remedy?

• A Increase the effort setting so selection is considered more carefully

More effort spends tokens reasoning over a menu that should have been trimmed, which is cost rather than a fix.

• B Split the server into several servers grouped by domain

Splitting the server leaves the same sixty tools in front of the agent, so selection is no easier than before.

• C Narrow the exposed set to the tools this agent actually needs

Correct. Selection degrades as the surface grows, so removing what this agent will never call addresses the cause directly.

• D Rename the tools so they sort into a more meaningful order

Ordering is not what the model routes on; it chooses from names and descriptions regardless of how they sort.

Selection degrades as the surface grows, so removing what this agent will never call is the change that addresses the cause. Splitting servers keeps the same total surface, renaming does not reduce it, and more effort spends tokens on an avoidable problem.

Developers sometimes paste live API keys into their prompts. The team wants such a prompt stopped before Claude processes it. Which hook fits?

• A A Stop hook that scans the finished turn and strips the key from the transcript

A Stop hook runs after the turn, once the key has already reached the model.

• B A SessionStart hook that reads the prompt and refuses to open the session

SessionStart fires as the session opens, before there is a prompt to inspect.

• C A PreToolUse hook that scans each tool's input and blocks any call carrying the key

By the time a tool call is proposed, the model has already read the prompt.

• D A UserPromptSubmit hook that detects the key and blocks the prompt, erasing it

Correct. UserPromptSubmit runs before processing and a block erases the prompt.

UserPromptSubmit fires when a prompt is submitted, before Claude processes it, and a block there rejects the prompt and erases it from context. PreToolUse and Stop both act after the model has already seen the key, and SessionStart fires when the session begins, before any prompt exists.

A coding agent runs the code it generates and reads untrusted web pages. Which deployment control most limits what a successful prompt injection can do?

• A Execution in a sandbox with restricted egress and no access to production credentials

Correct. Isolation caps what an injected instruction can reach.

• B The most capable model available, which is the least likely to follow injected text

A stronger model lowers the odds of success but does not limit the damage when it happens.

• C A weekly review of a random sample of sessions, looking for signs of injected text

Review finds incidents afterward; it does not contain them.

• D A system prompt line instructing the agent to ignore any instructions found in web pages

An instruction is itself text the injection can argue against; it bounds nothing.

Injection resistance in the model is never complete, so the deployment should assume an injection will sometimes succeed and bound its reach: an isolated environment that cannot call arbitrary hosts or use production credentials limits both exfiltration and damage. A prompt line and a stronger model reduce the odds without bounding the result, and sampled review detects rather than contains.

Code reads each reply with response.content[0].text. After thinking is turned on for the model, it starts failing. What is the robust fix?

• A Disable thinking again, since thinking and text output do not combine safely

Thinking and text coexist in the same response by design.

• B Read response.content[1].text instead, since thinking occupies the first block

A fixed index breaks again when the block layout changes.

• C Iterate over the content blocks and keep only those whose type field is text

Correct. Selecting by block type does not depend on position.

• D Join every block's text field into one string, whatever type each block is

Thinking blocks carry their content in a different field, and mixing it in would corrupt the answer.

A response's content is a list of typed blocks, and with thinking on, a thinking block can come before the text block; tool_use blocks can appear too. Selecting blocks by type works regardless of order. Hard-coding a different index just moves the assumption, disabling thinking gives up the feature to hide a parsing bug, and thinking blocks have no text field to join.