Pass the Anthropic Claude Certified Developer CCDV-F Questions and answers with CertsForce

Option B is correct because destructive production operations require deterministic enforcement outside the model’s probabilistic reasoning. Claude Code hooks can intercept lifecycle events before tool execution and explicitly allow, deny, or request further handling based on concrete rules.

Anthropic’s hooks documentation provides this exact security pattern. A PreToolUse hook can inspect a proposed command before execution and return a blocking decision. Anthropic’s example demonstrates blocking destructive operations such as drop table, while other commands proceed normally.

That mechanism can be adapted to database controls: block DROP, destructive DELETE, unauthorized schema modifications, or production writes; require explicit approval for high-risk operations; and allow read-only or known-safe queries automatically.

A merely increases the probability that someone might notice an unsafe operation and does not prevent execution. C assumes model capability can replace access controls, which is an unacceptable safety boundary. D is useful behavioral guidance but remains probabilistic and cannot guarantee prevention.

Therefore, B creates a deterministic control between model intent and side-effect execution. Relevant Study Guide topics: Claude hooks, PreToolUse, tool governance, deterministic enforcement, approval gates, least privilege, and destructive-operation protection.

===============

Option A follows disciplined production debugging: diagnose the actual failure mode before changing architecture or prompts. An output containing unsupported information might indeed be hallucination, but similar symptoms can result from stale conversation state, incorrect retrieval, unexpected tool output, prompt injection, incorrect request construction, or mismatched model/configuration versions.

A production trace should capture the user input, system instructions, relevant conversation history, retrieved content, tool calls and results, model/version, request parameters, response, and identifiers necessary to compare successful and failing cases. This establishes whether the model invented a fact or whether that fact entered context through another path.

B changes the model before establishing causality. C may eventually be useful if the confirmed problem is insufficient grounding, but implementing RAG before diagnosis can hide rather than explain the defect. D similarly changes prompting before verifying that prompt behavior is responsible.

The engineering sequence should be observe, reproduce, classify the failure, form a hypothesis, apply a targeted correction, and validate the correction with evaluations. Relevant Study Guide topics: production troubleshooting, observability, tracing, hallucination analysis, prompt injection, context failures, regression diagnosis, and lifecycle monitoring.

===============

Option D precisely matches Anthropic's SDK behavior. Official SDK documentation states that transient conditions are automatically retried two times by default with exponential backoff. The default retry set includes connection failures, HTTP 408 Request Timeout, 409 Conflict, 429 Rate Limit, and 5xx server errors. Developers can alter or disable this behavior through the SDK's retry configuration.

This directly eliminates A because the retry count is configurable. B is incorrect because rate-limit responses are among the conditions automatically retried by the supported SDKs; the API also provides retry-after information where applicable. C is incorrect because the SDK does not merely log these failures and continue without attempting recovery.

Application-level handling is still necessary after the configured retry policy is exhausted. Production code should distinguish permanent errors from transient failures, preserve request IDs for diagnostics, and decide whether higher-level fallback, queuing, or user-visible failure handling is appropriate.

Therefore, D correctly characterizes the SDK abstraction: useful retry defaults combined with developer control. Relevant Study Guide topics: Claude SDKs, transient errors, HTTP 429, retries, exponential backoff, configuration, and resilient API integration.

===============

Option A is correct because the safest guardrail architecture is defense in depth, not dependence on one control. Anthropic’s guardrail guidance explicitly recommends combining multiple safeguards: input screening and validation, hardened system instructions, safe handling of untrusted tool content, least-privilege permissions, output screening, monitoring, and red-team testing. The important engineering property is independence: if one layer misses an attack or unsafe request, another layer can still prevent harmful behavior or block delivery.

Option B places control only at the output boundary. Human review can be useful for high-risk cases, but it does not protect tool execution, data access, prompt injection, or other failures that can occur before final output. Option C relies on a single system-prompt control; system instructions are probabilistic and cannot provide complete enforcement against adversarial or malformed inputs. Option D is weaker still because model-level safety alone does not enforce application-specific policies.

Therefore, A best matches Claude Developer security guidance: layer preventive, detective, and enforcement controls so there is no single guardrail whose failure exposes the application. Relevant Study Guide topics: guardrails, prompt injection, input validation, output screening, least privilege, defense in depth, and production monitoring.

===============

Option A is correct because sensitive-data protection must occur before prohibited information crosses the application's trust boundary. If account numbers, passwords, or other secrets must not be sent to Claude, asking Claude to “ignore” those values after transmission does not satisfy the requirement. The application must determine which data is permitted to leave its controlled environment and transform or reject prohibited content before constructing the Claude request.

This principle is consistent with Anthropic's defense-in-depth guidance. Anthropic recommends input screening, limiting Claude's access to sensitive information, and applying least privilege so the model receives only information necessary for the task.

B is fundamentally too late: the sensitive information has already been transmitted to the model context before the system instruction can influence behavior. C is worse because logging can create an additional store containing the sensitive information and only detects exposure after it occurs. D implements some boundary filtering but deliberately leaves coverage incomplete until production incidents reveal additional patterns.

Therefore, A requires the boundary and its permitted data flows to be defined first, then enforced comprehensively through filtering, redaction, tokenization, or rejection. Relevant Study Guide topics: application boundaries, data minimization, sensitive-data handling, filtering, redaction, least privilege, and privacy-preserving design.

===============

Option C provides the required configuration-management discipline. Development, staging, and production may legitimately use different models, prompts, plugins, permissions, or service endpoints, but those differences must be explicit, reproducible, and auditable rather than scattered across undocumented mechanisms.

Claude Code documentation follows the same configuration-as-code principle. Project-level configuration can live in source-controlled files such as .claude/settings.json, while project instructions are maintained in repository-level CLAUDE.md. Anthropic specifically distinguishes shared project settings from local developer configuration.

A introduces uncontrolled model changes and regression risk. B hides configuration in application logic and makes environment differences harder to review. D ignores the fact that environments often require deliberate differences—for example, production credentials or pinned release versions.

The correct strategy is therefore to define configuration centrally, pin compatibility-sensitive dependencies, record environment-specific overrides, review modifications through source control, and retain rollback history. Relevant Study Guide topics: configuration management, environment isolation, model versioning, prompt versioning, dependency management, reproducibility, and controlled deployment.

===============

Option A is the appropriate trust-boundary treatment for external content. Untrusted text can contain malformed data, adversarial instructions, prompt-injection attempts, or content deliberately constructed to alter the agent's behavior. It should therefore be validated or screened before inclusion and clearly represented as untrusted data rather than authoritative application instructions.

Anthropic's prompt-injection guidance distinguishes direct attacks from indirect prompt injection, where Claude processes third-party content such as webpages, emails, documents, or tool output containing hostile instructions. Anthropic recommends input validation and screening, least-privilege access, safe treatment of untrusted tool content, and screening content before Claude acts on it. Importantly, Anthropic notes that tool-result content is treated as untrusted data rather than as a reliable place for application instructions.

B erases the trust distinction and exposes the application to instruction/data confusion. C introduces a deliberately weaker security boundary and does not sanitize the data. D prevents legitimate use cases unnecessarily; untrusted does not mean unusable—it means the data must be handled defensively.

Therefore, A correctly combines validation with explicit trust separation. Relevant Study Guide topics: prompt injection, untrusted content, input validation, sanitization, data/instruction separation, least privilege, and defense in depth.

B is directly supported by both the supplied examination source and Claude Code's configuration model. The source marks the hierarchical CLAUDE.md approach as correct. Claude Code supports instructions at multiple scopes, allowing broadly applicable standards to be separated from project-specific context rather than duplicated across every repository.

Anthropic documents several CLAUDE.md scopes. Organization-managed instructions can apply broadly; user-level instructions in ~/.claude/CLAUDE.md apply across a user's projects; project instructions in ./CLAUDE.md or ./.claude/CLAUDE.md provide repository-specific architecture, conventions, commands, and workflows. Claude Code loads applicable files according to the directory hierarchy, allowing broad instructions and more specific local instructions to coexist.

This arrangement improves maintainability because common coding standards are defined once at the appropriate scope, while each repository retains only the context unique to that project. A documentation website does not automatically inject rules into Claude Code context. C creates inconsistent manual configuration. D improperly couples unrelated repositories to one repository's configuration.

Relevant Claude Developer topics: Confia Management, CLAUDE.md hierarchy, organization scope, user scope, project scope, repository configuration, instruction inheritance, and configuration reuse .

===============