CCDV-F Practice Questions 2 — 50 Questions

Question 1

A developer builds a retrieval-augmented generation (RAG) system where Claude answers questions using documents stored in an internal knowledge base. The security team is concerned that a malicious document could contain instructions that hijack the model. Which design choice most effectively reduces this indirect prompt injection risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Treat retrieved document content as data only, place it in a clearly delimited user turn, and instruct the model to never follow instructions found inside retrieved content.. Indirect prompt injection occurs when untrusted retrieved content is interpreted as instructions. The most effective design mitigation is to keep retrieved text in a clearly delimited data section and tell the model never to follow instructions found there. This changes the model's parsing context and makes injected commands less likely to be executed, while supporting output validation. Encryption and summarization do not address the trust boundary.

Answer

Ask the model to summarize each retrieved document before answering the user's question.

Answer

Store all documents in a vector database encrypted at rest with AES-256.

Answer

Increase the number of retrieved documents so the malicious content is diluted among many chunks.

Question 2

A team wants Claude to query their internal ticketing system through MCP. The operations are read-only lookups and the team wants the model to decide when a lookup is needed based on the conversation. Which MCP primitive is the appropriate choice?

Accepted Answer

MCP Tools exposed by the server.. Because Claude must decide on its own when to look up a ticket, the capability needs to be a callable action with a described schema, which is exactly what an MCP tool provides. Resources and prompts are not model-selected actions, and sampling reverses the request direction, so a tool is the correct primitive for this read-only lookup.

Answer

MCP Resources exposed by the server.

Answer

MCP Prompts exposed by the server.

Answer

MCP Sampling requests initiated by the server.

Question 3

A developer is creating an MCP server that exposes a tool to query a PostgreSQL database. The tool definition includes a parameter 'sql_query' that accepts a raw SQL string. During a security review, it was flagged that this design could allow SQL injection if Claude generates malicious SQL. Which change should the developer make to mitigate this risk?

Accepted Answer

Replace the raw SQL parameter with structured parameters such as table name, columns, and filters, and construct the SQL query internally using parameterized statements.. The best mitigation is to replace raw SQL with structured parameters and construct queries internally using parameterized statements. This eliminates the injection vector by design. Other options either rely on unreliable prompting, weak validation, or partial mitigation that does not address the core vulnerability. Structured parameters also improve usability and safety.

Answer

Limit the database user's permissions to read-only, so even if malicious SQL is executed, it cannot modify data.

Answer

Add a description to the tool instructing Claude to never generate malicious SQL.

Answer

Validate the 'sql_query' parameter by checking that it only contains SELECT statements and no semicolons.

Question 4

A fintech company deploys a Claude-powered agent that can call internal tools such as `get_transaction_history` and `initiate_transfer`. During a red-team exercise, an attacker crafts a user message that causes the agent to call `initiate_transfer` to an attacker-controlled account. Which TWO controls most directly mitigate this tool-abuse risk? (Choose two.)

Accepted Answer

Validate tool arguments against a server-side allowlist of permitted destination accounts and enforce authorization checks in the tool implementation.. Tool abuse is mitigated by enforcing trust boundaries outside the model. A human approval gate for high-impact actions prevents unauthorized execution, and server-side argument validation with authorization ensures the tool only acts on permitted inputs. Prompt instructions and temperature changes are not enforceable, and logging without prevention is only detective. Together, the two preventive controls block the attack even if the model is manipulated.

Answer

Add a system prompt that tells Claude to never call `initiate_transfer` unless the user explicitly asks for it.

Answer

Log all tool calls and review them weekly for suspicious patterns.

Answer

Increase the model's temperature to make its behavior less predictable to attackers.

Question 5

A developer is building an MCP client that connects to a remote MCP server over HTTP. After the initial handshake, the client needs to discover what prompts the server exposes so they can be surfaced in a slash-command menu. Which MCP capability should the client invoke?

Accepted Answer

prompts/list. Prompt templates are a distinct MCP primitive from tools and resources, and they are enumerated with the prompts/list request. Because the goal is to build a slash-command menu of reusable prompts, the client must call prompts/list after the initialize handshake, then optionally fetch a specific prompt with prompts/get when the user selects it.

Answer

resources/list

Answer

tools/list

Answer

initialize

Question 6

An agent built with the Anthropic SDK is processing a long conversation and begins to exceed the model's context window. The developer wants to preserve recent turns and key facts while reducing token usage. Which approach best matches how the SDK and Claude are designed to handle this?

Accepted Answer

Summarize older portions of the conversation into a compact message and prepend it, keeping the most recent turns verbatim.. Because the API is stateless, context management is the developer's responsibility. Summarizing older conversation segments while retaining recent turns verbatim balances token economy with continuity. This pattern is widely used in long-running agents to stay within the context window without losing the facts that matter.

Answer

Rely on the model's built-in long-term memory to automatically recall earlier turns without resending them.

Answer

Increase the temperature setting so the model can compress the conversation on its own.

Answer

Remove all prior messages and send only the latest user turn to avoid any risk of exceeding the limit.

Question 7

A developer is working in a large repository and wants Claude Code to understand the project structure and available tools before making changes. They run `claude` in the project root. Which action best ensures Claude Code has the necessary context for the session?

Accepted Answer

Run `/init` to generate a CLAUDE.md file that documents the project structure and common commands.. Using `/init` generates a CLAUDE.md file that persists across sessions and captures essential project details like build commands and architecture. This is the intended mechanism for providing durable context in a new codebase. Other options either do not exist, provide only temporary input, or do not enhance Claude Code's understanding of the project.

Answer

Manually paste the entire directory tree into the first prompt.

Answer

Run `claude --verbose` to enable detailed logging of all file accesses.

Answer

Execute `claude --reset` to clear previous session memory and start fresh.

Question 8

A developer is using the Claude API to generate creative writing pieces. The application often sends the same 2,000-token instruction set as a prefix to every request. Which feature can reduce the cost of processing this repeated prefix?

Accepted Answer

Prompt Caching. Prompt Caching is specifically designed to reduce costs when the same prefix is reused across multiple API calls. By caching the 2,000-token instruction set, subsequent calls avoid reprocessing those tokens at full input rates, directly lowering the cost. Other features like streaming, Batch API, or model selection do not target the redundant processing of a repeated prefix.

Answer

Batch API

Answer

Streaming responses

Answer

Using a smaller model

Question 9

A developer is optimizing a Claude-powered chatbot that handles 50,000 daily conversations. Each conversation starts with a 1,200-token system prompt that includes detailed instructions and examples. The system prompt is identical across all conversations. The developer wants to reduce input token costs. Which technique should be applied?

Accepted Answer

Enable prompt caching for the system prompt.. Prompt caching is designed for scenarios where a large, static prefix is reused across many requests. By caching the 1,200-token system prompt, the developer pays full price only once, and subsequent requests benefit from reduced input token costs. This directly targets the repetitive cost without sacrificing quality or altering the conversation flow.

Answer

Shorten the system prompt by removing examples.

Answer

Move the system prompt to the first user message.

Answer

Switch to a cheaper model for all conversations.

Question 10

A developer is using the Claude API to generate marketing copy for 50 different product lines. Each request includes a unique set of product details and a unique creative brief. The developer wants to minimize cost while ensuring high-quality output. Which model should they choose?

Accepted Answer

claude-3-sonnet-20240229. Marketing copy generation requires creativity and coherence but not the deep reasoning of Opus. Sonnet provides a balanced combination of quality and cost, making it the most suitable for this task. Haiku might sacrifice quality, while Opus would be overkill and more expensive. Claude 2.1 is outdated. Therefore, Sonnet is the optimal choice to minimize cost while ensuring high-quality output.

Answer

claude-3-opus-20240229

Answer

claude-2.1

Answer

claude-3-haiku-20240307

Question 11

A developer is building a document-review assistant that must extract every monetary figure from contracts and cite the page where each figure appears. The contracts average 40 pages. Early tests show Claude misses figures that appear in tables and occasionally cites the wrong page. The developer wants to improve recall and citation accuracy without changing the model. Which approach is most effective?

Accepted Answer

Ask Claude to first list all candidate monetary figures with their page numbers, then verify each candidate against the source text before producing the final extraction.. Separating candidate generation from verification gives the model an explicit intermediate list it can check against the source, which catches table figures that a single extraction pass tends to skip. Verifying each page citation against the text before finalizing corrects misattributed page numbers, and the whole workflow stays within one model.

Answer

Instruct Claude to be thorough and to pay special attention to tables and page numbers in the contract.

Answer

Increase max_tokens so Claude has room to output more figures and longer citations.

Answer

Split each contract into 40 separate single-page prompts and merge the extracted figures afterward.

Question 12

A healthcare startup uses the Anthropic API to summarize patient intake forms. The security team requires that all protected health information (PHI) be redacted before the data leaves the application's trust boundary. A developer proposes using a custom regex to remove names and dates. Which approach best enforces the redaction requirement without exposing PHI to the model?

Accepted Answer

Apply a deterministic PHI-detection library (e.g., Presidio) to redact fields client-side, then send only the redacted payload to the Anthropic API.. The requirement is that PHI never leaves the application's trust boundary, so redaction must occur client-side before the API call. A vetted PHI-detection library provides deterministic, auditable removal of identifiers, unlike prompt instructions or hashing. This keeps the model input free of PHI while preserving enough clinical context for summarization, and it produces logs that satisfy compliance reviews.

Answer

Hash all input fields with SHA-256 before sending them to the Anthropic API.

Answer

Include a system prompt instructing Claude to ignore and not repeat any PHI in the input.

Answer

Send the raw text but request that Anthropic disable logging for the request via a custom header.

Question 13

A developer's MCP client launches a local stdio server that exposes a `query_metrics` tool. The server process writes diagnostic log lines to standard output while handling requests. Claude's tool calls intermittently fail with JSON parse errors on the client side. Which change best resolves this?

Accepted Answer

Configure the server to write all diagnostic logging to standard error instead of standard output.. The stdio transport dedicates standard output to JSON-RPC frames and standard error to diagnostics. When a server prints log lines to stdout, the client reads them as protocol data and fails to parse them, which matches the intermittent parse errors. Moving logging to stderr restores a clean protocol channel and lets the `query_metrics` tool calls complete normally without any transport redesign.

Answer

Wrap every log line in a JSON object so the client can skip non-protocol entries automatically.

Answer

Increase the client's request timeout so slow log writes do not corrupt the response stream.

Answer

Switch the server to HTTP with Server-Sent Events transport so logging no longer shares a channel with protocol data.

Question 14

A developer is building an agent that runs shell commands to inspect a repository. They want the agent to iterate autonomously but prevent destructive commands like deleting files outside the project directory. Which combination best enforces this boundary while preserving autonomy?

Accepted Answer

Route shell commands through a permission callback that inspects each command and denies those targeting paths outside the project directory.. Safety boundaries for autonomous agents must be enforced outside the model's discretion. A permission callback inspects every shell invocation before it runs and denies those reaching outside the project directory, which blocks destructive operations while still allowing the agent to iterate freely on permitted commands. Prompt guidance and token limits are advisory or orthogonal, and removing shell access discards needed capability.

Answer

Restrict the agent to read-only tools and remove shell execution entirely from its toolset.

Answer

Lower the model's max_tokens so it cannot compose long destructive command strings.

Answer

Rely on the system prompt instructing the model to never run destructive commands.

Question 15

A developer is using Claude to review pull requests. The prompt includes a 4,000-line diff followed by the question 'List any security issues.' Claude's answers are vague and sometimes reference the wrong file. The developer wants more precise, file-specific findings without switching models. Which change is most likely to improve precision?

Accepted Answer

Restructure the diff so each file is wrapped in its own labeled tag, and ask for findings in a per-file structured list.. Precision improves when the prompt gives the model clear boundaries and a specific output structure. Wrapping each file in labeled tags lets the model attribute findings to the correct file, and requesting a per-file structured list enforces specificity. Vague questions, broad essays, or extreme splitting lose the context and attribution needed for accurate, file-specific security findings.

Answer

Shorten the question to 'Any issues?' so the model has more room to reason about the diff.

Answer

Split the diff into 4,000 separate single-line prompts and merge the answers afterward.

Answer

Ask Claude to produce a long free-form essay about the overall code quality before listing issues.

Question 16

A developer registers a tool named get_order_status with an input_schema that declares order_id as a string. During testing, Claude repeatedly emits tool_use blocks where order_id is the numeric value 10482 instead of a string. The downstream API rejects numeric IDs. Which change most reliably fixes this at the tool-definition layer?

Accepted Answer

Add a description to the order_id property stating it must be a string, and include a format or pattern hint in the schema.. Tool argument types are steered by the tool definition itself, so the durable fix is to make the expected type explicit through property descriptions and schema constraints. Describing order_id as a quoted string with a numeric pattern gives Claude the signal it needs, and validating the payload before calling the downstream API provides defense in depth.

Answer

Set the tool_choice parameter to force get_order_status on every turn.

Answer

Raise max_tokens so Claude has more room to format the argument correctly.

Answer

Change input_schema to declare order_id as an integer so the numeric output becomes valid.

Question 17

A developer is building a Python application that streams responses from the Anthropic Messages API. They notice that when they set stream=True, the response object is an iterator of server-sent events. They want to extract only the incremental text chunks as they arrive, without waiting for the full message. Which event type should they filter for to get the text deltas?

Accepted Answer

content_block_delta. When streaming with the Messages API, the server sends a series of events. The content_block_delta event is specifically designed to carry incremental text deltas as Claude generates the response. By listening for this event type, the developer can process text as it arrives, enabling real-time user experiences. Other events like message_start, message_delta, and ping serve different purposes such as initialization, final metadata, or keep-alive.

Answer

message_delta

Answer

message_start

Answer

ping

Question 18

A developer is working in a large monorepo and wants Claude Code to automatically run `npm run lint` and `npm run test` after every file edit it makes, without needing to ask each time. Which Claude Code feature should the developer configure to achieve this?

Accepted Answer

Configure a PostToolUse hook in `.claude/settings.json` that matches the Edit and Write tools and runs the lint and test commands.. Hooks are the deterministic automation mechanism in Claude Code. A PostToolUse hook bound to the Edit and Write tools executes a configured shell command every time those tools complete, which guarantees `npm run lint` and `npm run test` run after each change without any prompt. Documentation files, slash commands, and permission flags influence behavior or require manual action but cannot enforce automatic post-edit execution.

Answer

Add a CLAUDE.md file at the repository root that documents the lint and test commands.

Answer

Enable the `--auto-approve` flag in the project's `.claude/settings.json` so Claude Code can decide when to run the commands.

Answer

Create a custom slash command named `/lint-test` in `.claude/commands` that runs both commands.

Question 19

A developer is using Claude Code to debug a complex issue. After several exchanges, Claude Code suggests a solution that involves modifying a configuration file outside the project directory. The developer is concerned about unintended side effects. What is the most appropriate way to handle this?

Accepted Answer

Reject the suggestion and ask Claude Code to propose a solution that stays within the project directory.. Rejecting the suggestion and asking for a solution confined to the project directory is the safest approach. It avoids potential side effects on other projects or the system. Claude Code can often provide alternatives that use project-local configuration, which are easier to manage and revert.

Answer

Accept the suggestion but create a backup of the configuration file first.

Answer

Use the `/undo` command to revert the suggestion and then manually edit the configuration file.

Answer

Allow the modification because Claude Code has context about the system.

Question 20

A developer writes an agent loop that handles Claude's tool_use blocks by executing each tool and appending a user message containing the tool_result blocks. In production, a request occasionally triggers a 400 error stating that the tool_use ids were not found. Reviewing the code, the developer sees the loop builds each new request by sending only the latest user message and the newest tool_result message, discarding earlier turns to save tokens. Which action resolves the error while preserving the agent's behavior?

Accepted Answer

Send the complete conversation history on every request, including the assistant turn containing the tool_use blocks that the tool_result messages reference.. Because the Messages API holds no server-side session, every request must include the prior assistant turn that emitted the tool_use blocks alongside the tool_result messages that cite those ids. Trimming history to save tokens removed the referenced blocks, so the API rejected the orphaned results. Sending the complete history, or a window that retains each referenced tool_use turn, restores valid correlation.

Answer

Generate a new UUID for each tool_result block and set the tool_use_id field to that fresh value so the results appear unique to the API.

Answer

Switch the loop to the Batches API so that multi-turn tool exchanges are processed together and prior messages are retained on the server.

Answer

Reduce the number of tools passed in the tools parameter so that fewer tool_use blocks are generated and fewer ids need to be matched.