CCAR-F Agentic Architecture and Orchestration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Raise the model's temperature so the agent explores alternative interpretations of the wiki text.

  Why it's wrong here

  Higher temperature increases variability and can make the agent more susceptible to creative misreadings of injected content. It does not add any security property. Injection defense comes from delimiting data, least privilege, and human approval, not from sampling diversity, which here would only degrade reliability.

• ✓

  Wrap retrieved wiki content in a clearly delimited block and instruct the model in the system prompt to treat that block as data, never as instructions.

  Why this is correct

  Delimiting untrusted content and labeling it as data reduces the chance the model treats embedded text as commands. This is a foundational defense against indirect prompt injection, because it separates the instruction channel from the data channel. It is not a complete solution on its own, but it materially lowers risk when combined with privilege separation.

• ✓

  Require an explicit human approval step before the agent sends any Slack message whose destination or content is derived from wiki content.

  Why this is correct

  Human-in-the-loop approval on actions influenced by untrusted content breaks the injection chain. Even if the model is manipulated into drafting a malicious message, a reviewer sees the destination and body before it is sent. This is a strong, practical control for irreversible side effects and complements input delimiting.

• ✗

  Give the agent a single credential with read access to wikis and write access to Slack so it can complete tasks without switching identities.

  Why it's wrong here

  Combining read and write privileges in one identity means injected instructions can immediately exercise the write capability, including messages to unintended channels. Least privilege calls for separating the read path from the action path, granting the Slack write capability only after an explicit, verified decision, not by default.

• ✗

  Rely on the wiki's own content moderation to strip malicious instructions before retrieval.

  Why it's wrong here

  The agent cannot assume upstream moderation is complete or current. Wiki pages can be edited after moderation, and injection payloads are often benign-looking prose. Defense must live in the agent architecture, through delimiting, least privilege, and approval gates, rather than depending on a third-party content pipeline.