CCDV-F Practice Test 10 — 10 Questions

Question 1

A developer is building a customer-facing chatbot using the Claude API. The bot must respond within 1.5 seconds on average. The team initially selected claude-3-opus-20240229 for its high quality, but latency is consistently above 3 seconds. They need to reduce latency while maintaining acceptable response quality. Which action should the developer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Switch to claude-3-haiku-20240307 and evaluate response quality against the original model.. The chatbot's strict latency requirement makes model selection critical. Opus prioritizes quality over speed, while Haiku is optimized for fast responses. Switching to Haiku directly addresses the performance bottleneck. The other options either do not affect model inference speed or only change how output is delivered, not how quickly it is produced. The developer should then verify that Haiku's quality is sufficient for the use case.

Answer

Increase the max_tokens parameter to allow the model to generate more tokens per response.

Answer

Add a system prompt instructing Claude to respond as quickly as possible.

Answer

Enable streaming in the API request so that tokens are delivered incrementally.

Question 2

A developer wants Claude Code to understand the team's API conventions, directory layout, and preferred testing framework for a specific service, and wants that guidance loaded automatically at the start of every session in that repository without typing it. What is the most appropriate way to accomplish this?

Accepted Answer

Place a CLAUDE.md file in the repository root containing the conventions, layout notes, and testing framework guidance.. CLAUDE.md is the designated project memory file. Claude Code automatically reads it at the start of a session in the repository, so conventions, layout notes, and testing framework preferences placed there are available without manual effort. Manual pasting, unsupported settings fields, and scattered code comments cannot deliver the same consistent, automatic, repository-wide context loading that the developer needs.

Answer

Add the conventions as comments in a source file that Claude Code is likely to read during the session.

Answer

Create a `.claude/settings.json` entry with a `systemPrompt` field containing the conventions.

Answer

Paste the conventions into the first message of each session before asking for changes.

Question 3

A developer is preparing to deploy a Claude-powered internal assistant that can query a customer database through a tool. Before release, the security team asks for evidence that the assistant cannot be manipulated into returning another customer's records. Which practice provides the strongest proactive assurance?

Accepted Answer

Run a red-team exercise with adversarial prompts and tool-call attempts, and fix any issue where the assistant returns records outside the caller's authorized scope.. The strongest proactive assurance comes from actively attempting to break the authorization boundary and verifying that the system holds. Red-teaming with adversarial prompts and tool-call attempts tests the real behavior of the assistant and its tools, and fixing any discovered access-control failures before release produces evidence the security team can rely on. Prompt instructions, larger context, and after-the-fact monitoring do not enforce or prove the boundary.

Answer

Add a system prompt that says the assistant must only return records belonging to the authenticated user.

Answer

Monitor production logs after launch and alert when the assistant returns records that look unusual.

Answer

Increase the model's context window so it can hold all relevant customer records and reason about authorization more reliably.

Question 4

A developer stores the Anthropic API key in a mobile application's source code so the app can call Claude directly from the device. A security review flags this as a critical issue. Which remediation best addresses the root cause?

Accepted Answer

Move the Anthropic API calls to a backend service and have the mobile app authenticate to that service instead of holding the API key.. Secrets embedded in client binaries are recoverable by anyone who obtains the app, so the only durable fix is to remove the credential from the client. A backend proxy keeps the Anthropic API key server-side, lets you enforce user-level authentication and quotas, and allows key rotation without redistributing the application.

Answer

Restrict the API key to a single IP address range so only the corporate network can use it.

Answer

Obfuscate the API key using a commercial mobile app hardening tool before shipping the build.

Answer

Rotate the API key on a fixed schedule and embed the new key in each app release.

Question 5

A developer is building an internal Claude-powered assistant that calls the Anthropic API. The security policy states that API keys must never be embedded in client-side code or committed to source control. Which practice best satisfies this requirement?

Accepted Answer

Store the API key in a server-side secrets manager and have the backend proxy requests to the Anthropic API.. The secure pattern is to keep the Anthropic API key server-side in a managed secrets store and route all model calls through a backend proxy. That way the credential is never shipped to clients or stored in source control, and the backend can add authorization, rate limiting, and audit logging. Client-side encoding or committing to a private repo does not remove exposure.

Answer

Generate a new API key for each user session and embed it in the session cookie.

Answer

Obfuscate the API key with Base64 encoding before embedding it in the client bundle.

Answer

Commit the key to a private repository and rely on repository access controls.

Question 6

A developer is building an agent that must decide when to call tools versus when to respond directly to the user. The agent uses the Anthropic SDK with tool definitions supplied in the request. Which TWO behaviors correctly describe how the model handles tool use in this setup? (Choose two.)

Accepted Answer

The model can return a normal text response instead of a tool_use block when it determines no tool is required.. Claude decides whether to call a tool and, if so, emits a tool_use block with the name and arguments; it may also answer directly with text when no tool is needed. The application, not the model, performs execution and returns results, which is why the agent loop must handle both tool_use and plain text outcomes.

Answer

The model requires the tool's input_schema to be omitted so it can choose parameters freely.

Answer

The model automatically retries a failed tool call until it succeeds without developer intervention.

Answer

The model executes the tool itself and returns the result directly in the same response.

Question 7

A developer is preparing a Messages API request and wants to give Claude a persistent persona: "You are a concise legal assistant. Never give advice outside contract review." Where should this instruction be placed so it applies to the whole conversation?

Accepted Answer

In the system parameter, as the top-level system prompt for the request.. The system parameter is purpose-built for top-level instructions that define Claude's role, tone, and boundaries for the whole request. Placing the legal-assistant persona there gives it consistent influence over all turns and separates standing guidance from conversational content. Other fields either carry no model-visible text or serve unrelated control functions.

Answer

As the first user message in the messages array, prefixed with "System:".

Answer

Inside a metadata object attached to the request body.

Answer

In the stop_sequences parameter so Claude stops when it deviates from the persona.

Question 8

A developer is integrating the Messages API into a backend service. They want to send a multi-turn conversation where the assistant previously produced a tool call that returned a result. Which content structure should they send back to continue the conversation correctly?

Accepted Answer

A user message whose content array contains a tool_result block referencing the tool_use id, followed by any additional user text as separate blocks.. Tool results belong in a user-turn message as tool_result content blocks, each carrying the tool_use_id from the assistant's prior tool_use block. Additional user text can be included as sibling content blocks. This structured pairing preserves the call-result relationship the API expects, letting Claude incorporate the returned data and continue the conversation coherently.

Answer

A system message that appends the tool output to the original system prompt so it persists for all future turns.

Answer

An assistant message echoing the tool name and its output so the model can read its own prior decision before answering.

Answer

A single user message containing the raw tool output as plain text, labeled with the tool name in parentheses.

Question 9

A developer wants Claude Code to add input validation to a specific function in `src/api/users.py`. Which instruction is most likely to produce a correct, targeted change?

Accepted Answer

In `src/api/users.py`, add validation to the `create_user` function that rejects requests where `email` is missing or lacks an `@` character, and return a 400 with a clear message.. Targeted instructions that specify file, function, validation rules, and expected error behavior produce minimal, verifiable edits. Claude Code performs best when the scope and acceptance criteria are explicit, because it can act confidently without guessing. Vague, unbounded, or purely documentary prompts either miss the goal or create unnecessary churn across the repository.

Answer

Check all the inputs everywhere and fix anything that looks wrong.

Answer

Make the code better.

Answer

Add a TODO comment in the users module about validation.

Question 10

A developer is using the Claude Messages API to process a 50,000-token document for a summarization task. The summarization prompt and instructions add another 1,000 tokens. The developer wants to minimize output token costs while ensuring a comprehensive summary. Which strategy is most effective?

Accepted Answer

Craft a prompt that instructs Claude to produce a concise summary within a specified token limit, such as 'Summarize in under 500 tokens.'. To minimize output token costs while ensuring a comprehensive summary, the developer should control the output length through prompt instructions. Explicitly requesting a concise summary within a token limit guides the model to generate only the necessary content, reducing cost without sacrificing quality. Other strategies like chunking or using a smaller model may address different concerns but do not directly target output token reduction.

Answer

Split the document into smaller chunks and summarize each separately, then combine the summaries.

Answer

Set the max_tokens parameter to a very low value, such as 100.

Answer

Use a smaller model like Claude 3 Haiku for summarization.