Pass the Anthropic Claude Certified Developer CCDV-F Questions and answers with ExamsMirror

Option A is correct because the safest guardrail architecture is defense in depth, not dependence on one control. Anthropic’s guardrail guidance explicitly recommends combining multiple safeguards: input screening and validation, hardened system instructions, safe handling of untrusted tool content, least-privilege permissions, output screening, monitoring, and red-team testing. The important engineering property is independence: if one layer misses an attack or unsafe request, another layer can still prevent harmful behavior or block delivery.

Option B places control only at the output boundary. Human review can be useful for high-risk cases, but it does not protect tool execution, data access, prompt injection, or other failures that can occur before final output. Option C relies on a single system-prompt control; system instructions are probabilistic and cannot provide complete enforcement against adversarial or malformed inputs. Option D is weaker still because model-level safety alone does not enforce application-specific policies.

Therefore, A best matches Claude Developer security guidance: layer preventive, detective, and enforcement controls so there is no single guardrail whose failure exposes the application. Relevant Study Guide topics: guardrails, prompt injection, input validation, output screening, least privilege, defense in depth, and production monitoring.

===============

Option B reflects the fundamental generative behavior of large language models. Claude does not retrieve a fixed response template for a given prompt. Instead, it generates the response incrementally, selecting subsequent tokens according to the probability distribution produced by the model. Consequently, semantically equivalent runs can differ in wording, ordering, whether prompt language is quoted, and whether it is paraphrased.

Anthropic's API documentation explicitly describes sampling parameters as controlling randomness in subsequent-token selection and also states that even configurations intended to minimize randomness do not make output completely deterministic. Current Claude model generations increasingly manage sampling internally, but the underlying principle remains: generative output is not guaranteed to be textually identical across equivalent calls.

Therefore, seeing the original prompt echoed in one response and paraphrased in another does not, by itself, demonstrate malformed request construction. A real request-construction problem should instead be established through traces showing different system instructions, messages, parameters, or context.

A, C, and D incorrectly infer specific implementation faults without supporting evidence.

The supplied question identifies B as the correct response. Relevant topics: SW Eng Foundations, token generation, sampling, nondeterminism, debugging, and model behavior.

===============

Option D combines the three key properties of a reliable Claude tool: an explicit contract, clear tool-selection guidance, and controlled execution failure handling. Anthropic's tool documentation defines user tools using a name, detailed description, and JSON input_schema. The description should explain what the tool does, when it should and should not be used, parameter semantics, and relevant limitations. Anthropic emphasizes that precise descriptions materially improve Claude's ability to select the correct tool.

A clear schema prevents ambiguous parameter interpretation and allows validation before calling the external pricing API. Where stronger guarantees are required, Anthropic also supports strict tool use, which constrains generated tool inputs to the declared JSON Schema.

The application's execution layer must also convert pricing-service failures into explicit, handled error paths rather than uncontrolled exceptions. A deprives Claude of critical selection information. B increases malformed-call risk. C delegates infrastructure reliability to the reasoning loop instead of implementing appropriate integration error handling.

Therefore, D represents production-quality custom-tool construction. Relevant Study Guide topics: custom tools, JSON Schema, tool descriptions, validation, external API integration, and error handling.

===============

D applies configuration as code and is the answer explicitly selected in the supplied examination source. Claude Code treats project configuration as part of the repository's working context. Anthropic documents project-level CLAUDE.md as the mechanism for providing project instructions and context, while shared project configuration belongs in .claude/settings.json. Crucially, Anthropic states that .claude/settings.json is intended to be checked into source control and shared with the team .

Keeping these files alongside the code establishes a single versioned relationship between application behavior and the configuration that influences Claude Code. Standard pull requests then provide diffs, peer review, ownership controls, CI validation, audit history, and straightforward rollback. A particular commit can therefore reproduce both source code and its associated Claude project configuration.

A creates competing copies and synchronization risk. B artificially separates behavior configuration from the code version it affects. C creates the same problem specifically for settings.json.

Developer-local values remain distinct: .claude/settings.local.json exists specifically for settings that should not be committed.

Relevant Claude Developer topics: Confia Management, CLAUDE.md, settings.json, configuration as code, source control, pull-request review, reproducibility, auditability, and team-shared Claude Code configuration .

Option A correctly treats this as a context-dependent format drift problem rather than an arbitrary model failure. Because the application initially produces valid JSON and progressively loses structure over subsequent turns, the investigation should focus on how accumulated conversation history changes the instructions and examples visible to Claude. Earlier malformed outputs, conflicting instructions, tool results, or unnecessary historical content can gradually reduce adherence to the intended format.

The application should therefore inspect the conversation state, preserve the authoritative formatting requirement, prune irrelevant content where appropriate, and validate outputs at the application boundary. Anthropic's Structured Outputs capability is specifically designed to prevent malformed structured responses by constraining Claude to a supplied JSON Schema. Official guidance states that Structured Outputs provide valid, parseable, schema-compliant results for downstream processing.

B destroys the response rather than correcting the failure mode. C resets state but prevents meaningful multi-turn operation and does not diagnose why context causes drift. D changes model characteristics without establishing that the model is responsible.

The supplied question on page 12 identifies A as correct. Relevant topics: Agent Architecture, context engineering, format drift, structured outputs, context evolution, schema validation, and long-running conversations.

===============

Option C follows a prompt-chaining/workflow decomposition pattern. Ticket classification and reply generation are materially different tasks. Triage may require a constrained category, priority, or routing decision, while response generation requires richer context, tone, policy compliance, and customer-facing language. Splitting the stages allows each Claude call to use a prompt, context set, model configuration, output format, and evaluation criterion appropriate to that specific responsibility.

Anthropic's guidance on effective agentic systems distinguishes predictable workflows from open-ended agents and recommends using the simplest architecture that meets requirements. Predefined workflows are particularly appropriate where work can be divided into clear processing stages.

This decomposition also creates useful engineering boundaries: the triage output can be validated before becoming input to the drafting stage; triage accuracy and response quality can be evaluated independently; and either stage can later be optimized without rewriting the entire process.

A unnecessarily restricts the second stage to rules. B introduces expensive parallel generation and a selection step without a stated requirement. D optimizes solely for call count while sacrificing task separation and observability.

The supplied exam source marks C. Relevant topics: Agent Patterns, prompt chaining, workflow decomposition, focused prompts, stage-level evaluation, and modular Claude application design.

===============

Option D applies the correct hybrid pattern. Anthropic distinguishes workflows—where LLMs and tools execute along predefined code paths—from agents, where the model dynamically determines how to proceed. Anthropic recommends choosing the simplest architecture that meets the requirement: workflows provide predictability and consistency for well-understood tasks, while agents are valuable where flexible model-driven decisions are necessary.

Standard invoice processing is explicitly described as a small number of known steps. That makes a deterministic workflow the appropriate default because the path can be tested, monitored, and reproduced. The unexpected-format branch is different: the system must reason among rerouting, requesting clarification, or human escalation. That decision point is where agentic flexibility adds value.

A makes the entire process autonomous even though most steps do not require autonomy, increasing cost, latency, and unpredictability. B introduces multiple specialized agents despite no demonstrated need for that complexity. C collapses deterministic processing and exception handling into one monolithic model call, making validation and debugging harder.

Therefore, D combines workflow predictability with targeted agentic reasoning. Relevant Study Guide topics: workflows versus agents, routing, exception handling, hybrid agentic architecture, escalation, and complexity minimization.

===============

Option D is the strongest enforcement design because an unconditional content policy requires an application-level control between model generation and user delivery. Prompt instructions are valuable for steering Claude, but they are probabilistic controls and should not be treated as the sole enforcement mechanism when prohibited categories must never be exposed.

Anthropic’s guardrail guidance recommends layered safeguards including screening, validation, monitoring, and filtering rather than relying exclusively on prompts. Its prompt-leak guidance specifically recommends output screening and post-processing, including deterministic techniques such as keyword matching, regular expressions, or other text-processing mechanisms where appropriate.

A improves the probability of policy compliance but cannot guarantee that every generated response will satisfy an externally defined application policy. B explicitly abandons the requirement. C detects violations only after exposure, which is unsuitable when the content must not reach users.

A production architecture can combine system instructions, structured classification, policy engines, deterministic rules, and model-based moderation, but the decisive requirement is enforcement before output delivery. Relevant Claude Developer topics are guardrails, output filtering, content moderation, deterministic enforcement, defense in depth, safe application boundaries, and production Claude application design.

===============