View Full Anthropic CCA-F Exam Dumps and Practice Test Dumps.

 

Question 321

An agent is asked to delete a customer’s account, but the request does not specify whether the user wants permanent deletion or temporary deactivation. What should the agent do?

1. Permanently delete the account immediately
2. Deactivate the account without asking
3. Ask the user to clarify the intended action
4. Delete only the customer’s recent data

Correct Answer: 3

Explanation

Account deletion is a potentially irreversible operation, so ambiguity should be resolved before taking action. Permanent deletion and temporary deactivation can have significantly different consequences for the customer, stored data, billing, and recovery options. The agent should therefore ask the user to clarify which operation they intend. This is an example of matching agent autonomy to the risk and reversibility of the action. For destructive operations, confirmation and precise identification of the target operation are important safeguards. The application should also enforce authorization and deletion policies independently of the model.

Question 322

Which practice is most appropriate when an agent handles API credentials?

1. Include credentials directly in every prompt
2. Store credentials in secure secret-management infrastructure
3. Place credentials in publicly accessible configuration files
4. Ask the model to generate credentials when needed

Correct Answer: 2

Explanation

API credentials should be protected using secure secret-management mechanisms rather than being placed directly into prompts, source code, public configuration files, or model-visible context. Secret-management systems can provide controlled access, rotation, auditing, and environment-specific credentials. The model generally does not need to see the secret itself; the application can authenticate tool requests on the model’s behalf. This separation reduces the risk of accidental disclosure through logs, responses, or prompt-injection attacks. Production credentials should also be separated from development credentials and granted only the permissions required for the associated operation.

Question 323

An agent needs to retrieve a customer’s current account balance. Which tool design is most appropriate?

1. A narrowly scoped read-only balance lookup tool
2. A tool that can modify all account information
3. A tool with unrestricted database access
4. A general-purpose shell command with database credentials

Correct Answer: 1

Explanation

A narrowly scoped read-only tool is preferable when the agent only needs to retrieve account balance information. Such a tool exposes a limited capability and reduces the risk of unintended modifications or access to unrelated data. A general-purpose database or shell interface provides substantially broader privileges than the task requires. This design follows the principles of least privilege and focused tool responsibilities. The tool should still enforce authorization so that the requesting user can access the specified account. Narrow interfaces also make testing, monitoring, and auditing easier because the intended behavior is clearly defined.

Question 324

An agent’s response depends on inventory information that may change every few minutes. What should the application do?

1. Use an old cached value indefinitely
2. Ask the model to estimate the current inventory
3. Ignore inventory freshness
4. Retrieve sufficiently fresh inventory data before making the decision

Correct Answer: 4

Explanation

When information changes frequently, stale data can cause incorrect decisions. For inventory-related workflows, the application should retrieve sufficiently fresh information from an authoritative source before confirming availability or making a purchase-related decision. The appropriate freshness requirement depends on the business process. A cache may still be useful if its expiration policy meets the required freshness level. The model should not be expected to infer current inventory from previous conversations or generate an estimate. Freshness requirements should be implemented at the application or data layer rather than relying solely on the model.

Question 325

What is a key reason to use separate development, testing, and production environments for an agent application?

1. To prevent developers from writing code
2. To eliminate the need for access controls
3. To reduce the risk that testing changes affect production systems
4. To ensure all environments use identical credentials

Correct Answer: 3

Explanation

Environment separation reduces the chance that experiments, configuration changes, or test operations will affect real production data and users. Development and testing environments can use synthetic or controlled datasets, while production uses appropriately protected resources. Separate credentials and permissions further reduce risk. This separation is particularly important for agent systems because testing may involve tool calls that create external side effects. A developer should not normally test destructive production operations simply because the agent can access them. Environment boundaries provide an additional layer of protection against accidental changes and configuration mistakes.

Question 326

An agent receives a malformed customer ID from a user. What should happen before the ID is used in a database operation?

1. The application should validate the identifier format and reject invalid input
2. The agent should guess the intended ID
3. The database should receive the malformed value without validation
4. The application should substitute the first customer ID it finds

Correct Answer: 1

Explanation

Identifiers should be validated before they are passed to downstream systems. Validation can include checking format, length, allowed characters, and potentially whether the identifier exists and belongs to the authorized customer. Guessing an identifier can lead to accessing or modifying the wrong account. Input validation also helps reduce errors and provides a predictable failure path for malformed requests. For security-sensitive operations, validation should occur at the application or service boundary rather than relying only on the model. The database layer should continue enforcing its own integrity and authorization controls.

Question 327

Which situation most strongly justifies requiring human approval before an agent executes an action?

1. Generating a short summary
2. Formatting a text document
3. Calculating a simple percentage
4. Executing a high-impact irreversible financial transaction

Correct Answer: 4

Explanation

Human approval is particularly valuable for actions that are high impact, difficult to reverse, or capable of causing significant financial, legal, or operational consequences. A large financial transfer, for example, may warrant explicit confirmation or human review before execution. In contrast, low-risk activities such as summarization generally do not require the same level of oversight. The exact approval threshold depends on the application’s risk model. Human review should complement, rather than replace, authorization, validation, logging, and other technical safeguards.

Question 328

An agent repeatedly calls the same tool because it does not recognize that the task has already completed. Which mechanism can help prevent this behavior?

1. Removing all tool descriptions
2. Defining explicit completion conditions and termination states
3. Increasing the number of available tools
4. Allowing unlimited retries

Correct Answer: 2

Explanation

Explicit completion conditions help an agent determine when a workflow has achieved its intended outcome. Without clear termination criteria, an agent may continue calling tools unnecessarily, increasing latency, cost, and the possibility of duplicate side effects. A workflow can define states such as pending, in_progress, completed, and failed, with clear rules for transitioning between them. Maximum iteration counts or execution budgets can provide additional protection against loops. Completion detection should be supported by application logic where possible rather than relying entirely on the model to recognize that no further action is required.

Question 329

A tool can both retrieve and permanently delete files. How should these capabilities ideally be exposed to an agent?

1. As one unrestricted command
2. With deletion automatically enabled for every request
3. As separate, clearly defined capabilities with appropriate safeguards
4. By allowing the model to modify the tool’s permissions

Correct Answer: 3

Explanation

Read and destructive operations have different risk profiles and should generally be separated. A read operation can be exposed through a narrowly scoped retrieval tool, while permanent deletion can have additional authorization, confirmation, and audit requirements. Combining unrelated capabilities into one unrestricted command increases the consequences of an incorrect tool selection or malicious input. Separate tools also make permissions easier to manage and logs easier to interpret. The application should independently enforce authorization and validation so that the model cannot bypass restrictions simply by requesting a destructive operation.

Question 330

An agent is using a tool that returns a structured error containing an error code and a retryable flag. How should the application use this information?

1. Ignore the error structure
2. Retry every error indefinitely
3. Treat every error as successful
4. Use the structured fields to determine the appropriate recovery behavior

Correct Answer: 4

Explanation

Structured errors allow an application to distinguish different failure conditions and respond appropriately. For example, a retryable field can indicate that a temporary service problem may be retried, while a validation error should normally be corrected rather than repeatedly submitted. Error codes can also support user-friendly messages, monitoring, and automated recovery. The application should still impose retry limits and consider whether repeating an operation is safe. Structured error handling is more reliable than asking the model to infer the nature of an error from an unstructured text message alone.

Question 331

Why is idempotency important for agent workflows that may retry requests?

1. It ensures repeated execution does not unintentionally create duplicate side effects
2. It makes every API request faster
3. It removes the need for authorization
4. It guarantees that the model cannot make mistakes

Correct Answer: 1

Explanation

Idempotency is important when an operation may be retried because of timeouts, network failures, or temporary service errors. An idempotent operation can be safely repeated without creating unintended duplicate effects. For example, a payment API may use an idempotency key so that a retry does not charge the customer twice. Without such protection, an agent that cannot determine whether its previous request succeeded could accidentally perform the same action multiple times. Idempotency should be implemented at the API or application layer, especially for financial transactions and other operations with significant external side effects.

Question 332

A customer asks an agent to send an email, but several recipients have similar names. What should the agent do before sending it?

1. Select the first matching contact
2. Send the email to all matching contacts
3. Ask the customer to identify the intended recipient
4. Guess based on previous conversations

Correct Answer: 3

Explanation

Recipient ambiguity should be resolved before sending an external message. Selecting a recipient based on name order or an unsupported assumption could disclose information to the wrong person. The agent should ask the customer to clarify the intended recipient, preferably using an email address, contact identifier, or another unambiguous attribute. Since sending an email creates an external side effect, the workflow may also require confirmation depending on the application’s risk policy. The email tool itself should validate recipient permissions and addresses before transmission.

Question 333

Which approach is most appropriate for evaluating whether an agent update caused a regression?

1. Compare the updated system against a representative evaluation suite
2. Test only the new feature manually once
3. Assume the update is safe if the model responds fluently
4. Remove all previous test cases

Correct Answer: 1

Explanation

A representative evaluation suite provides a consistent way to compare system behavior before and after an update. It can include normal user requests, edge cases, tool-selection tests, security scenarios, and previously observed failures. Comparing results helps identify regressions that may not be visible during a single manual test. Agent systems can change behavior because of modifications to prompts, tools, models, retrieval systems, or application logic. Regular evaluations therefore provide important protection against unintended changes. Production monitoring can complement offline testing by identifying failures that were not represented in the evaluation suite.

Question 334

An agent retrieves information from multiple customer accounts in a multi-tenant system. What control is essential?

1. Allowing the agent to search every tenant by default
2. Enforcing tenant-level access controls on the retrieved data
3. Trusting the model to select the correct tenant
4. Removing customer identifiers from all requests

Correct Answer: 2

Explanation

Multi-tenant systems require strict isolation so that one customer or organization cannot access another tenant’s information. The application or data layer should enforce tenant boundaries independently of the model. A model may misunderstand a customer identifier or be manipulated through prompt injection, so relying on model behavior alone is insufficient. Queries should be scoped to the authorized tenant, and access checks should occur before data is returned. Logging and monitoring can further help detect unusual cross-tenant access patterns. Tenant isolation is a fundamental security requirement when an agent handles data belonging to multiple customers.

Question 335

What should an agent do if a user request conflicts with a higher-priority application instruction?

1. Follow the lower-priority request
2. Ignore all application instructions
3. Follow the applicable higher-priority instruction while handling the request safely
4. Disable the application’s safety controls

Correct Answer: 3

Explanation

Agent systems typically operate under a hierarchy of instructions and constraints. Higher-priority application or system requirements should not be overridden simply because a user requests something different. The agent should follow the applicable higher-priority instruction while still trying to satisfy the user’s legitimate request within those boundaries. This is particularly important for privacy, security, authorization, and tool-use restrictions. Application-level controls should also be enforced outside the model wherever possible because prompt hierarchy alone should not be considered a complete security mechanism.

Question 336

An agent is processing confidential customer information. Which logging approach is generally preferable?

1. Log every confidential field in plain text
2. Avoid all monitoring and logs
3. Send complete records to external analytics systems
4. Log necessary operational information while minimizing or protecting sensitive data

Correct Answer: 4

Explanation

Logging is important for troubleshooting, security monitoring, and auditing, but sensitive information should not be logged unnecessarily. A better approach is to record operational metadata such as request identifiers, timestamps, tool names, status, and error categories while redacting or excluding confidential fields. Where sensitive data must be retained for a legitimate reason, access controls, encryption, and appropriate retention policies should be applied. This balances observability with privacy and security. Logging policies should be designed deliberately rather than allowing tools or agents to automatically record entire customer records.

Question 337

An agent has a maximum execution budget of 10 tool calls. It reaches the limit before completing the task. What should it do?

1. Continue indefinitely until completion
2. Report that the execution limit was reached and provide the appropriate partial status
3. Pretend the task was completed
4. Reset the counter automatically without authorization

Correct Answer: 2

Explanation

Execution budgets help prevent runaway loops, excessive costs, and uncontrolled tool activity. If the agent reaches its configured limit before completing the workflow, the system should stop further execution and report the actual state. If some steps succeeded, that partial completion should be communicated clearly. Automatically resetting the budget defeats the purpose of the safeguard and could allow indefinite execution. Depending on the workflow, the system may provide a controlled option to resume later or ask the user for confirmation. Execution limits should be treated as application-level controls rather than suggestions for the model.

Question 338

Which practice helps ensure that an agent’s tool invocation can be traced back to the relevant request?

1. Removing request identifiers
2. Using correlation or trace IDs across the workflow
3. Logging only the final natural-language answer
4. Creating a new unrelated identifier for every internal event

Correct Answer: 2

Explanation

Correlation or trace identifiers allow events from the same workflow to be connected across application components. For an agent system, a single request may involve model calls, retrieval operations, multiple tool invocations, and external API requests. A shared trace identifier makes it easier to reconstruct what happened and investigate failures or unexpected actions. The identifiers themselves should not contain sensitive information. Structured tracing can also support performance analysis, debugging, and auditing. Good observability combines trace information with timestamps, tool names, statuses, and relevant error details while respecting data-minimization requirements.

Question 339

An agent must change a customer’s billing plan. Which approach provides an appropriate safeguard?

1. Allow any authenticated user to change any customer’s plan
2. Let the model select a plan without checking availability
3. Validate the target account, requested plan, authorization, and required confirmation before applying the change
4. Apply the most expensive plan by default

Correct Answer: 3

Explanation

Billing-plan changes can affect recurring charges and customer access, so multiple safeguards are appropriate. The system should verify that the target account is correct, that the requested plan exists and is available, and that the requester has authorization to make the change. Depending on the business process, explicit confirmation may also be required before the change becomes effective. These checks should be performed by the application or billing service rather than relying solely on the model. Audit logging can record the requested change, authorization result, and final outcome for later investigation.

Question 340

What is the best reason to keep agent tools narrowly focused on specific responsibilities?

1. Focused tools make authorization, testing, and behavior easier to control
2. Focused tools always eliminate model errors
3. Focused tools remove the need for application security
4. Focused tools allow unrestricted database access

Correct Answer: 1

Explanation

Narrowly focused tools make an agent system easier to reason about and secure. A tool designed specifically to retrieve order status has a clearer purpose and smaller permission scope than a general-purpose tool that can read and modify an entire database. Focused tools are also easier to test because their expected inputs, outputs, and side effects are well defined. Authorization can be scoped to the specific capability, and monitoring can detect unusual usage more effectively. Although focused tools reduce risk, they do not eliminate the need for authentication, authorization, validation, logging, and other application-level safeguards.