View Full Anthropic CCA-F Exam Dumps and Practice Test Dumps.

 

Question 261

An agent needs to access a customer’s account information. Which approach provides the strongest access control?

1. Allow the agent to access any account it can identify
2. Let the model decide whether access is appropriate
3. Require authenticated identity and enforce authorization for the requested account
4. Trust the customer’s name as sufficient verification

Correct Answer: 3

Explanation

Access to customer information should be controlled by trusted application infrastructure. Authentication establishes who is making the request, while authorization determines whether that identity is allowed to access the requested account. The model should not independently decide whether access is permitted because model reasoning is not a reliable security boundary. A customer’s name is also insufficient because multiple people may share names or provide another person’s information. Backend authorization should verify the relationship between the authenticated user and the requested resource before the data is returned to the agent.

Question 262

What is an important advantage of using machine-readable tool outputs instead of relying only on free-form text?

1. They make validation and downstream processing more reliable
2. They guarantee that the model always chooses the correct tool
3. They eliminate all API failures
4. They prevent users from changing requests

Correct Answer: 1

Explanation

Machine-readable outputs provide a predictable structure that applications can validate and process consistently. For example, a tool can return fields such as status, record_id, error_code, and message rather than requiring another component to interpret arbitrary prose. Structured responses make it easier to distinguish success, failure, partial completion, and pending states. They also support automated validation and more reliable orchestration. However, structured output does not guarantee correct reasoning or eliminate external failures. It is a design mechanism that improves the reliability of communication between tools, agents, and application components.

Question 263

An agent is asked to cancel a customer’s subscription, but the request does not specify which subscription because the customer has multiple active subscriptions. What should the agent do?

1. Cancel every subscription
2. Cancel the newest subscription
3. Select the cheapest subscription
4. Ask the user to identify the intended subscription

Correct Answer: 4

Explanation

The request is ambiguous and cancellation creates a potentially significant external side effect. The agent should not guess which subscription the user intends to cancel. Instead, it should present the relevant choices or ask the user for a unique identifier, such as the subscription name or ID. Automatically canceling all subscriptions could cause unintended loss of service, while choosing based on age or price has no basis in the user’s request. Resolving the ambiguity before execution preserves user control and reduces the risk of performing an irreversible or financially consequential action incorrectly.

Question 264

Which practice is most useful for reducing prompt injection risks when an agent uses retrieved documents?

1. Treat every document instruction as authoritative
2. Separate untrusted retrieved content from trusted application instructions
3. Give retrieved documents higher priority than system instructions
4. Allow documents to modify tool permissions

Correct Answer: 2

Explanation

Retrieved documents should generally be treated as untrusted data rather than as instructions that can override application policies. A document may contain malicious text intended to manipulate the model into revealing confidential information or performing unauthorized actions. Separating retrieved content from trusted system and application instructions helps preserve the intended instruction hierarchy. Tool permissions should also be enforced independently by the application. Retrieval systems can provide relevant content while preventing that content from gaining authority over security controls. Additional validation and monitoring can further reduce the impact of prompt injection attempts.

Question 265

An agent must call a tool that requires a date and time. The user says, “Book it for tomorrow at 3 PM,” but the relevant time zone is unknown. What is the safest approach?

1. Clarify the applicable time zone before booking
2. Use the server’s time zone automatically
3. Choose the user’s most recently used time zone without confirmation
4. Book the event in UTC without telling the user

Correct Answer: 1

Explanation

Relative dates and times can be ambiguous when the relevant time zone is unknown. “Tomorrow at 3 PM” could result in different actual appointment times depending on the user’s location or the location of the event. Because booking creates an external side effect, the agent should clarify the time zone when it materially affects the action. Automatically choosing a server or default time zone can result in an incorrect booking. A clear clarification question ensures that the agent performs the requested action according to the user’s actual intent.

Question 266

Which situation is most appropriate for using a read-only tool instead of a write-enabled tool?

1. Changing an account password
2. Sending a customer refund
3. Retrieving an order’s current status
4. Deleting an inactive account

Correct Answer: 3

Explanation

Retrieving an order’s current status is a read-only operation because it does not modify the underlying data. A read-only tool is preferable because it provides the required information while minimizing permissions and reducing the possibility of unintended side effects. Password changes, refunds, and account deletion are write operations that modify state and therefore require stronger authorization and validation. Using the least powerful tool that can satisfy the request is a useful security principle. It also makes auditing and testing easier because each tool has a clearly defined responsibility.

Question 267

An agent receives a response indicating that an external service is temporarily unavailable. What should the workflow do?

1. Mark the operation as permanently successful
2. Use bounded retries with appropriate backoff when retrying is safe
3. Retry continuously without delay
4. Modify the user’s request randomly

Correct Answer: 2

Explanation

A temporary service-unavailable error may recover after a short period, so controlled retry behavior can be appropriate. The application should use bounded retries and backoff rather than repeatedly sending requests without delay. If the operation creates side effects, it should also be idempotent or otherwise protected against duplicate execution. If the service remains unavailable after the retry limit, the agent should report the failure accurately. Treating the operation as successful would provide false information, while unlimited retries could create excessive resource consumption and additional pressure on the unavailable service.

Question 268

Why should an AI agent have explicit limits on the tools it can call?

1. To make every workflow require manual execution
2. To prevent the agent from generating natural-language responses
3. To reduce unnecessary capabilities and limit potential impact
4. To ensure that all available tools are used

Correct Answer: 3

Explanation

Limiting available tools reduces the agent’s attack surface and helps enforce least privilege. An agent should generally have access only to the capabilities necessary for its assigned workflow. If an agent responsible for customer support is given unrestricted access to payment administration, database deletion, and account management, an incorrect decision could have much greater consequences. Narrow tool access also simplifies evaluation, authorization, monitoring, and debugging. Tool restrictions should be implemented through application-level permissions rather than relying only on the model to voluntarily avoid capabilities that it should not use.

Question 269

A developer changes a tool’s required parameter from customer_id to account_id. What should be done before deploying the change?

1. Update the tool schema and test dependent workflows
2. Deploy immediately because the names are similar
3. Ignore existing evaluation cases
4. Allow the model to determine the new parameter automatically

Correct Answer: 1

Explanation

Changing a required tool parameter can affect prompts, model behavior, application code, validation, and other workflows that depend on the tool. The schema and documentation should be updated consistently, and affected workflows should be tested before deployment. Regression tests can identify cases where the agent still supplies the old parameter or where downstream components expect the previous structure. Simply assuming the model will understand the change can produce malformed tool calls. Controlled versioning and testing help ensure that tool changes do not silently break existing agent behavior.

Question 270

Which information should generally be included in an audit record for a sensitive agent action?

1. Only the final natural-language response
2. No information about the operation
3. Unrelated user data
4. Relevant identity, action, timestamp, target, and outcome information

Correct Answer: 4

Explanation

An audit record should contain enough relevant information to reconstruct and investigate a sensitive action without unnecessarily collecting unrelated personal data. Depending on the system, useful fields may include the authenticated identity, operation performed, target resource, timestamp, request or execution ID, and result. Sensitive values should be minimized or redacted when they are not necessary. The purpose of auditing is accountability and investigation, not indiscriminate data collection. Appropriate audit records can help determine what happened during an incident and whether an action was authorized and successfully completed.

Question 271

An agent is asked to provide a customer’s full profile, but the application only needs the customer’s shipping status. What should the agent retrieve?

1. The complete profile
2. Only the information necessary to determine shipping status
3. All historical customer records
4. Every field available in the database

Correct Answer: 2

Explanation

The agent should retrieve only the information required to answer the user’s actual question. If shipping status can be determined from an order identifier and shipment status field, there is no need to retrieve unrelated personal, financial, or historical information. This reduces context usage and limits sensitive-data exposure. Data minimization is especially important when information passes through multiple components or external services. The goal is not to remove information needed for accurate processing, but to avoid collecting or exposing data that has no role in completing the requested task.

Question 272

What should an agent do if a tool returns a permission_denied error?

1. Retry the exact request indefinitely
2. Use another user’s credentials
3. Report the authorization issue or request an approved authorization path
4. Pretend the operation succeeded

Correct Answer: 3

Explanation

A permission-denied response indicates that the current identity or context is not authorized to perform the requested operation. Repeating the same request will generally not resolve the underlying authorization problem. The agent should communicate the limitation clearly and, if the application supports it, direct the user toward an approved process for obtaining the necessary permission. It should never attempt to bypass access controls or use another person’s credentials. Backend authorization should remain the enforcement mechanism, while the agent communicates the result and helps the user understand the next legitimate step.

Question 273

An application wants to compare two versions of an agent after a prompt update. Which result provides the most useful evidence of a regression?

1. The new version produces fewer characters
2. The new version takes slightly longer to start
3. A previously passing safety or tool-use test now fails
4. The new version has a different internal configuration identifier

Correct Answer: 3

Explanation

A regression occurs when behavior that previously met an expected requirement no longer does so after a change. A previously passing test that now fails is therefore meaningful evidence of a regression. Examples include incorrect tool selection, failure to enforce authorization, malformed structured output, or unsafe behavior in a known scenario. Response length or configuration identifiers do not directly demonstrate that functionality has degraded. Repeatable evaluation suites provide a stronger basis for detecting these changes because they allow developers to compare behavior across versions using the same scenarios and expected outcomes.

Question 274

Which design best supports safe handling of an agent’s destructive tool?

1. Give it unrestricted access because destructive actions are rare
2. Add scoped permissions, validation, and appropriate confirmation controls
3. Remove all logging
4. Allow any retrieved document to trigger deletion

Correct Answer: 2

Explanation

Destructive tools should have stronger safeguards because their actions may be difficult or impossible to reverse. Scoped permissions limit what the tool can affect, while input validation helps ensure that the intended resource and operation are correct. Depending on the risk, explicit confirmation or human review may also be appropriate. Audit logging provides accountability and helps investigate unexpected activity. Allowing arbitrary retrieved content to trigger deletion would create a serious prompt injection risk. A layered design reduces the likelihood and potential impact of accidental, unauthorized, or manipulated destructive operations.

Question 275

An agent receives two tool results that disagree about a customer’s account status. What should it do?

1. Randomly choose one result
2. Follow the defined source-priority or conflict-resolution policy
3. Average the two statuses
4. Invent a third status

Correct Answer: 2

Explanation

When authoritative sources disagree, the agent should follow an established conflict-resolution policy rather than arbitrarily selecting or inventing information. The system may define one source as authoritative for account status or use timestamps, provenance, and data quality indicators to determine which result should be trusted. If the conflict cannot be resolved automatically, the agent may need to report the discrepancy or request human review. Silently averaging incompatible statuses is not meaningful. Clear provenance and source-priority rules make conflict handling more predictable and auditable.

Question 276

Why should external tool results be validated before being used to trigger another high-impact action?

1. External results can be malformed, unexpected, or inconsistent with the expected schema
2. Tool results are always malicious
3. Validation guarantees the next action will succeed
4. External APIs never provide structured responses

Correct Answer: 1

Explanation

External services can return unexpected data because of bugs, configuration changes, API version differences, partial failures, or malformed responses. Before a tool result is used to trigger another consequential action, the application should validate important fields and ensure they meet the expected schema and business rules. For example, an unexpected account identifier should not automatically be passed into a payment operation. Validation does not guarantee success, but it creates an important safety boundary between external data and subsequent actions. This is especially important when the next operation has significant or irreversible consequences.

Question 277

An agent is configured to send customer emails automatically. Which control can reduce the risk of sending an incorrect message?

1. Remove all recipient validation
2. Allow arbitrary recipients from tool output
3. Validate recipients and relevant message details before sending
4. Disable all email records

Correct Answer: 3

Explanation

External email sending can create reputational, privacy, and operational consequences, so relevant details should be validated before the message is sent. Recipient addresses, subject, message content, and any important attachments or links should be checked according to the application’s policies. Depending on the workflow, explicit confirmation may also be appropriate. Removing validation increases the chance of sending information to the wrong person. Disabling records also reduces accountability. The goal is to ensure that the agent’s intended action matches the actual message and recipients before an irreversible external communication occurs.

Question 278

Which approach is appropriate when an agent’s tool call exceeds the maximum allowed execution time?

1. Continue waiting forever
2. Treat the operation as automatically successful
3. Retry without any timeout
4. Stop according to the timeout policy and report the resulting status accurately

Correct Answer: 4

Explanation

Timeouts prevent a single tool operation from consuming resources indefinitely. When a timeout occurs, the application should follow its defined policy, which may include a bounded retry if the operation is safe to repeat. The system must also distinguish between “the request timed out” and “the operation definitely failed,” because an external service may have completed the action even if the response was not received. For high-impact operations, idempotency and status reconciliation can be especially important. The agent should communicate the known status rather than automatically claiming success or failure without evidence.

Question 279

What is a major benefit of defining explicit completion states such as completed, failed, and pending?

1. They make workflow status easier for applications and users to interpret
2. They guarantee that every workflow completes successfully
3. They eliminate all retry requirements
4. They allow the agent to ignore tool results

Correct Answer: 1

Explanation

Explicit completion states provide a consistent way to represent the current status of a workflow. A completed state can indicate that the required operation finished successfully, while failed can indicate that it could not be completed and pending can represent work that is still in progress. These states help applications determine what action should happen next and allow agents to communicate accurate information to users. They do not guarantee success or eliminate retries. Instead, they create a clearer interface for orchestration, monitoring, error handling, and partial-completion scenarios.

Question 280

An agent must access an external service containing sensitive customer data. Which design is generally most appropriate?

1. Send the customer’s entire profile to the service
2. Use the minimum required data with authorized, scoped access
3. Allow unrestricted access because the service is external
4. Include authentication credentials in the model’s prompt

Correct Answer: 2

Explanation

When an external service is necessary, the application should send only the information required for the specific operation and use appropriately scoped authorization. This reduces the amount of sensitive customer data exposed outside the core system. Credentials should be managed securely by the application rather than placed in prompts where they could potentially be exposed. The service should also be authorized to receive the information and should use appropriate security controls. Combining data minimization with least-privilege access helps reduce privacy and security risks while still allowing the agent to complete legitimate external-service operations.