CCAR-F Practice Test 5 — 25 Questions

Question 1

A document-processing agent extracts structured fields from scanned contracts and must return a JSON object matching a strict schema. The agent also calls an OCR tool when text is unreadable. Which TWO design choices best ensure reliable, schema-valid output? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Validate the tool input against the JSON Schema in the orchestrator and return a corrective `tool_result` when validation fails.. Reliability comes from constraining generation and validating the result. A tool whose input schema matches the target structure forces the model to produce conforming arguments, and orchestrator-side JSON Schema validation with corrective `tool_result` feedback lets the agent fix violations in-loop. Together they replace free-form guessing with a validated, self-correcting extraction step.

Answer

Ask the agent to output the JSON twice and compare the two strings for equality.

Answer

Set the model temperature to its maximum so the agent explores multiple extraction interpretations.

Answer

Remove the OCR tool so the agent relies solely on the model's vision capability.

Question 2

A team is configuring Claude Code for a new project. They want to enforce specific tool permissions to prevent Claude Code from executing potentially dangerous shell commands without approval. Which two configuration approaches should they use? (Choose two.)

Accepted Answer

Define allowed and disallowed tools in the project's .claude/settings.json file.. Tool permissions in Claude Code are configured via settings.json files, either at the project level (.claude/settings.json) or user level (~/.claude/settings.json). Project settings allow team-wide enforcement and can be version-controlled. Global settings provide a fallback but are user-specific. Together, they can restrict tools like shell execution. Interactive commands and environment variables are not persistent configuration methods.

Answer

Add a .claudeignore file listing tools to exclude.

Answer

Set the CLAUDE_TOOL_POLICY environment variable to 'restricted'.

Answer

Use the /permissions command during a session to interactively adjust tool access.

Question 3

You are architecting a system that uses Claude to answer legal questions based on a corpus of case law. To maximize reliability and minimize hallucinations, which TWO practices should you implement? (Choose two.)

Accepted Answer

Implement a retrieval-augmented generation (RAG) pipeline that fetches relevant case law excerpts and includes them in the prompt.. The two most effective practices are using a system prompt that constrains Claude to provided excerpts and requires citations, and implementing a RAG pipeline to supply relevant case law. Together, they ensure the model's answers are grounded in actual sources, reducing hallucinations. Other options like high temperature or fine-tuning do not directly address grounding.

Answer

Ask Claude to generate a confidence score for each answer.

Answer

Fine-tune Claude on the entire corpus of case law.

Answer

Set the temperature to 1.0 to encourage diverse legal interpretations.

Question 4

A platform team ships a Claude-based service that classifies incoming tickets into one of eight categories and returns a JSON object with category and confidence. In production they observe two failure modes: the model sometimes returns a category outside the eight allowed values, and occasionally returns confidence as the string "high" instead of a number. Which TWO changes most directly reduce these failures while keeping the pipeline automated? (Choose two.)

Accepted Answer

Add a validation step that parses the JSON, checks category against the allowed list and confidence against a numeric range, and re-prompts with the specific error when either check fails.. Schema-constrained tool input directly prevents out-of-set categories and non-numeric confidence by enumerating and typing the fields, while a validating re-prompt loop catches any residual drift and feeds the exact error back for correction. Together they address both failure modes structurally. Sampling and length parameters do not constrain vocabulary or type, and unverified prose instructions are too weak for production.

Answer

Ask the model in the prompt to 'be careful and always use one of the eight categories', and trust the instruction without further checks.

Answer

Increase max_tokens so the model has more room to produce the JSON object without truncation.

Answer

Raise the temperature to 0.7 so the model explores more phrasing and is less likely to repeat a bad category.

Question 5

An architect is designing an MCP server that will be used by multiple Claude clients, each with different tool requirements. The server currently exposes all tools to every client. The architect wants to reduce the risk of a client accidentally invoking a tool it should not use, while keeping the server maintainable. Which approach best fits this goal?

Accepted Answer

Implement role-based access control (RBAC) at the MCP server, exposing only the tools permitted for the authenticated client's role.. Implementing RBAC at the MCP server lets you filter the tool list per authenticated client based on role. Clients only see and can invoke permitted tools, reducing accidental misuse. This centralizes policy, avoids duplicating servers, and is maintainable. It enforces least privilege without relying on prompts or documentation.

Answer

Expose all tools but add a warning in each tool's description about which clients should use it.

Answer

Create a separate MCP server instance for each client, each with a hardcoded subset of tools.

Answer

Rely on each client's system prompt to instruct the model to only use certain tools.

Question 6

An architect is building a customer-support agent that calls a `lookup_order` tool. The tool occasionally returns HTTP 503 errors during peak hours. The architect wants the agent to recover from transient failures without human intervention. Which approach best fits Claude's agentic tool-use loop?

Accepted Answer

Append a `tool_result` block containing the error message and `is_error: true`, then send the conversation back to Claude so it can decide to retry or try another approach.. The agentic loop expects every tool_use block to be answered by a matching tool_result. When the underlying call fails, the orchestrator must still reply, marking the result with is_error so the model sees the failure and can plan a retry, fallback, or clarifying question. Hiding or suppressing the error removes Claude's ability to reason about recovery.

Answer

Terminate the agent turn and return a generic 'service unavailable' message to the end user.

Answer

Increase the model's `max_tokens` parameter so Claude has more room to reason about the failure.

Answer

Silently retry the `lookup_order` call up to five times inside the host application before returning any result to Claude.

Question 7

An engineer repeatedly types the same multi-step instruction: run the unit tests, then fix any failing assertions, then re-run the suite until it passes. They want to invoke this reliably with a short, memorable name in Claude Code. What should they create?

Accepted Answer

A custom slash command defined as a Markdown file containing the instruction. Custom slash commands exist to capture frequently repeated prompts behind a memorable name. A Markdown command file stores the exact instruction text, and invoking the command by its filename replays that workflow consistently. This is lighter and more predictable than hooks or memory files, and far simpler than standing up an MCP server for a prompt the engineer already writes by hand.

Answer

A hook configured in settings.json that fires before every tool call

Answer

An MCP server that exposes the testing workflow as a tool

Answer

A new entry in the CLAUDE.md memory file describing the testing preference

Question 8

An architect is reviewing an MCP server that exposes a tool to create support tickets. The tool currently returns a plain text confirmation. The architect wants to improve how the model and client application consume the result. Which two changes should the architect make? (Choose two.)

Accepted Answer

Return a structured JSON object containing the ticket ID, status, and canonical URL, and declare an output schema for the tool.. Tool results should be structured so the model can reference precise fields and the client can act on them, and an output schema makes that contract explicit. Pairing machine-readable fields with a concise summary field gives the model a safe phrase to relay to the user. Together these changes improve reliability, reduce token waste, and support downstream automation.

Answer

Return the result as a Markdown table embedded in a text block so it renders nicely in chat clients.

Answer

Add a boolean success field and omit all other data to keep the response as small as possible.

Answer

Return the full HTTP response from the ticketing backend, including headers and trace IDs, so the model has maximum information.

Question 9

A travel assistant maintains a long conversation with a user over several days. The system prompt defines a strict booking policy, but by the fortieth turn Claude begins offering refunds that violate that policy. The team wants to keep the full history for continuity while preventing policy erosion. Which architecture best addresses this?

Accepted Answer

Re-assert the booking policy as a system-level instruction periodically or before policy-sensitive actions.. Policy drift over long conversations is countered by keeping the governing instruction salient near the decision point. Periodically re-asserting the booking policy, or injecting it before policy-sensitive actions, preserves full history while restoring the constraint's influence. Truncation, larger output limits, and user-driven reminders do not address the loss of instruction salience across many turns.

Answer

Delete older turns once the conversation exceeds thirty messages so only recent context remains.

Answer

Ask the user to restate the booking policy at the start of each session.

Answer

Increase the model's max_tokens so it has more room to recall the policy when answering.

Question 10

A platform team is building a Claude-powered service that returns structured records to a downstream database. During testing, roughly 4% of responses include a friendly sentence before the JSON, and another 3% omit a required field entirely. Which TWO changes most directly reduce these failure modes? (Choose two.)

Accepted Answer

List every required field with its type and a short description, and instruct the model to include all fields even when a value is unknown.. The two observed defects have distinct causes: conversational framing produces leading sentences, and unstated field requirements produce omissions. An instruction forbidding any text outside the JSON object fixes the first, while enumerating every field with its type and a rule for unknown values fixes the second. Token budget, temperature, and format changes do not target either root cause and would leave both failure rates essentially unchanged.

Answer

Switch the output format from JSON to a comma-separated list to simplify parsing.

Answer

Lower the temperature to 0 and rely on that alone to eliminate both the preamble and the missing fields.

Answer

Increase max_tokens substantially so the model has room to complete every field.

Question 11

An architect is building a Claude agent that must extract structured data from scanned invoices and then call an ERP API for each invoice. During early testing, the agent occasionally calls the ERP API with incomplete fields because it invents missing values. The architect wants to prevent these hallucinated field values from reaching the ERP. Which approach best addresses this requirement using the Anthropic Messages API?

Accepted Answer

Define the ERP submission tool with a strict JSON Schema that marks required fields and adds a second validation tool Claude must call before erp_submit to confirm extracted values against the source text.. Tool schemas in the Anthropic Messages API constrain the shape of tool_use input, so required fields and typed values are enforced structurally. Pairing that with an explicit verification step before the ERP tool closes the loop on values Claude could not actually read from the scan. Increasing tokens, streaming, or relying on downstream ERP validation leaves hallucinated content in the pipeline and does not satisfy the goal of preventing invented fields from reaching the ERP.

Answer

Switch the model to a smaller Claude Haiku variant to reduce creative generation, and rely on the ERP API's own field validation to reject bad submissions.

Answer

Increase the max_tokens value and add a system prompt instructing Claude to be accurate when reading invoices, then enable streaming so partial tool inputs arrive faster.

Answer

Set the tool_choice parameter to {"type": "tool", "name": "erp_submit"} so Claude must call the ERP tool on every turn, and validate the fields inside the ERP tool handler.

Question 12

A development team is building an internal document Q&A tool. They want Claude to answer strictly from uploaded policy PDFs and to decline questions the documents do not cover. Which prompt structuring technique best supports this requirement?

Accepted Answer

Provide the documents inside XML tags and instruct Claude to answer only using content within those tags, declining otherwise.. Strict document-scoped answering needs two things: unambiguous boundaries around the source material and an explicit instruction about what to do when the sources are silent. Delimiting the PDFs in XML tags gives Claude a referable container, while the decline instruction supplies the fallback behavior. Sampling tweaks, example counts, and knowledge-first ordering all leave the sourcing boundary undefined.

Answer

Ask Claude to answer from its general knowledge first, then compare with the documents afterward.

Answer

Increase the number of few-shot examples to fifty so the model learns the answering pattern.

Answer

Set the top_p parameter to 0.1 to make the model choose only high-probability tokens.

Question 13

An agent that reconciles invoices is failing intermittently. Logs show it sometimes calls `approve_payment` before `verify_vendor`, even though the system prompt lists `verify_vendor` first. The agent has 12 tools available. Which change most directly reduces this ordering violation?

Accepted Answer

Add a programmatic gate that rejects `approve_payment` calls until a successful `verify_vendor` result exists in the conversation state.. Prompt ordering is a soft hint; models can still invert steps under varying context. The reliable fix is a deterministic guard in the orchestrator that inspects conversation state and blocks `approve_payment` until a valid `verify_vendor` result is present. This preserves the tools' distinct roles while guaranteeing the compliance rule.

Answer

Reduce the tool count by removing unrelated tools so the model has fewer choices.

Answer

Merge `verify_vendor` and `approve_payment` into one tool with a single parameter object.

Answer

Raise the model temperature to encourage more exploratory tool selection.

Question 14

An architect is hardening an agent that uses tools to read internal wikis and send Slack messages. Which TWO practices most directly reduce the risk that untrusted wiki content causes the agent to take unauthorized actions? (Choose two.)

Accepted Answer

Wrap retrieved wiki content in a clearly delimited block and instruct the model in the system prompt to treat that block as data, never as instructions.. Two complementary controls break indirect prompt injection: treating retrieved content strictly as data via delimiters and system-prompt framing, and inserting a human approval gate before irreversible actions that were influenced by that content. Together they reduce both the chance of manipulation and the blast radius if manipulation occurs.

Answer

Raise the model's temperature so the agent explores alternative interpretations of the wiki text.

Answer

Give the agent a single credential with read access to wikis and write access to Slack so it can complete tasks without switching identities.

Answer

Rely on the wiki's own content moderation to strip malicious instructions before retrieval.

Question 15

You are designing a prompt for Claude to convert a customer email into a JSON object with fields "customer_name", "order_id", and "issue_summary". During testing, about 15% of outputs include the JSON inside markdown code fences (```json ... ```) or add a friendly sentence before the JSON. You need the raw JSON object only, with no extra text, every time. Which approach is most effective?

Accepted Answer

Add a prefill to the assistant turn containing the opening brace `{` so Claude must continue directly with the JSON body.. Prefilling the assistant turn with the opening brace of the JSON object forces Claude to continue directly from that character, structurally preventing any preamble or markdown fence. Instructions and sampling parameters only bias the model toward the desired format; they do not enforce it. The prefill is the deterministic, Anthropic-recommended technique for guaranteeing raw structured output.

Answer

Increase the max_tokens parameter to give the model more room to complete the full JSON object.

Answer

Lower the temperature to 0 and rely on deterministic sampling to remove the extra text.

Answer

Add the instruction 'Do not use markdown' to the system prompt and repeat it in the user turn.

Question 16

An agent must classify incoming support tickets and then route each to one of four specialized sub-agents. The architect notices the router sometimes dispatches the same ticket to two sub-agents. Which design change most directly prevents duplicate dispatch?

Accepted Answer

Give the router a single `route_ticket` tool whose input schema requires one category, and have the orchestrator execute only the first matching tool_use.. Exactly-once routing is an orchestration invariant. Encode the intent in a single tool with an enumerated category, and enforce it in the host by executing at most one routing tool_use per turn. This combination gives the model a clear decision surface while making duplicate dispatch structurally impossible, regardless of sampling behavior.

Answer

Lower the router's temperature to reduce randomness in classification.

Answer

Add a system-prompt sentence telling the router to select exactly one category.

Answer

Increase the number of categories so each ticket has an obvious best match.

Question 17

A team is using Claude to generate a structured incident report from raw log excerpts. The report must contain a 'summary' paragraph, a 'root_cause' field, and a 'remediation' list. During review, engineers find that remediation steps sometimes appear inside the summary paragraph, and summaries sometimes contain root-cause speculation. Which technique most reliably keeps each piece of content in its designated section?

Accepted Answer

Define each section with XML tags and include a one-line description of what belongs in each tag, then instruct Claude to place content only within the matching tag.. Content stays in its designated section when each section is a named container with an explicit description of its contents. XML tags provide those containers and the descriptions disambiguate which material belongs where, so remediation steps have their own list and root-cause analysis has its own field. Narrative formats, generic guidance, and randomized ordering do not create the structural boundaries the task requires.

Answer

Ask Claude to write the report as a single flowing narrative and let reviewers sort the content into the three sections afterward.

Answer

Randomize the order of the three sections on each invocation so the model learns to keep them separate.

Answer

Increase the length of the prompt by adding several paragraphs of general guidance about good report writing.

Question 18

A financial analyst wants Claude to extract the total amount due from each invoice in a batch of 300 PDF-extracted text blobs, returning results as JSON with fields "invoice_id", "amount_due", and "currency". Some invoices list multiple line items and a subtotal, while others show only a single grand total. Which prompt design most reliably produces consistent, machine-parseable extraction across all invoices?

Accepted Answer

Provide a strict JSON schema with the three required fields, instruct Claude to output only valid JSON, and include two worked examples covering both single-total and multi-line-item invoices.. Reliable batch extraction requires a fixed schema, an explicit instruction to emit only JSON, and few-shot examples that cover every structural variant in the input set. Combining a named-field schema with instruction and examples constrains the model's output shape so a parser can consume it without manual intervention. Free-text, high-temperature, or echo approaches all fail to yield consistent, machine-readable fields.

Answer

Ask Claude to 'summarize the key financial figures' and parse whatever numbers appear in the free-text response.

Answer

Ask Claude to return the entire invoice text unchanged so the analyst can manually locate the amount due in each document.

Answer

Set the temperature to 1.0 so Claude produces varied outputs, then use a fuzzy regex to catch any dollar amounts in the response.

Question 19

An architect is designing a Claude agent that must autonomously handle customer disputes end to end. The agent may issue refunds up to $200, but any refund above that amount must be approved by a human reviewer. The system must not block the entire workflow while waiting for approval. Which orchestration pattern best satisfies these constraints?

Accepted Answer

Model the refund as a tool that returns a pending status plus a case identifier, persist the agent state, and resume the conversation when the human decision arrives.. Human-in-the-loop patterns work best when the agent yields rather than blocks. A refund tool that returns a pending status with a case identifier lets the orchestrator persist the conversation and resume it when the reviewer decides. This keeps the workflow responsive, avoids tying up connections, and cleanly injects the approval or denial back into the agentic loop as a new tool_result.

Answer

Have the agent call a refund tool that internally pauses the HTTP request until a human approves, then returns the result in the same tool_result.

Answer

Route all disputes to a queue processed only by humans, removing the agent from the approval path entirely.

Answer

Instruct the agent in the system prompt to always ask the customer to wait while it internally polls the approval service every few seconds.

Question 20

A developer is extracting line items from invoices. The prompt includes a schema and examples, yet Claude occasionally invents field names not in the schema. Which change most directly prevents hallucinated field names?

Accepted Answer

Define the extraction schema as a tool 'input_schema' and force tool use.. Expressing the extraction schema as a tool 'input_schema' and forcing tool use constrains Claude's output to the defined fields. Because the API validates the tool call input against the schema, invented field names are structurally prevented. This is stronger than examples, temperature tuning, or negative instructions, which only influence behavior probabilistically.

Answer

Lower the temperature to 0 to reduce randomness in field name selection.

Answer

Add more few-shot examples showing correct field names.

Answer

Instruct Claude in the system prompt to 'never add fields not in the schema'.