McAfee Secure

Exam Code: CCA-F

Exam Name: Claude Certified Architect - Foundations

Certification Provider: Anthropic

Questions & Answers

Anthropic CCA-F Questions & Answers

Study with Up-To-Date REAL Exam Questions and Answers from the ACTUAL Test

Questions & Answers

134 Questions & Answers with Testing Engine

"Claude Certified Architect - Foundations Exam", also known as CCA-F exam, is a Anthropic certification exam.

Pass your tests with the always up-to-date CCA-F Exam Engine. Your CCA-F training materials keep you at the head of the pack!

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Was: $137.49
Now: $124.99

Anthropic CCA-F Practice Test 17

Question 160

A Claude Code team wants all contributors to use the same approved MCP test-server configuration from the repository. What deployment scope fits?

  1. Use a personal machine-only configuration and assume the team inherits it.
  2. Place every teammate's API token directly in the project config.
  3. Use version-controlled project-scoped MCP configuration while keeping individual credentials outside committed files.
  4. Copy the server binary into the prompt whenever a session starts.

Explanation

Correct Answer

C:

Shared configuration improves reproducibility without exposing personal secrets.

Incorrect Answers

A:

User-local files do not automatically appear on other machines.

B:

Committing credentials would expose privileged access.

D:

Prompts are not a reliable deployment mechanism.

Question 161

A developer commits a local cloud token inside a shared MCP server configuration. How should the setup be corrected?

  1. Obfuscate the token using base64 and keep committing it.
  2. Give the token to more developers to reduce individual troubleshooting.
  3. Remove and rotate exposed secrets, then use protected environment or credential management for authentication.
  4. Ask Claude not to mention the token while leaving it in the repository.

Explanation

Correct Answer

C:

Secrets should not travel with versioned project configuration.

Incorrect Answers

A:

Encoding is reversible and not secure storage.

B:

Wider distribution increases the risk rather than solving it.

D:

A leaked credential remains usable regardless of chat output.

Question 162

Several clients consume a company's MCP service; a recent deployment renames output fields without a compatibility plan. What should the architects introduce?

  1. Let each model guess which field replaced the missing one.
  2. Remove all schema definitions to make changing fields easier.
  3. Stable versioned schemas, backward-compatibility policy and contract tests for tool interfaces.
  4. Return identical generic strings for every operation regardless of data type.

Explanation

Correct Answer

C:

Clients need predictable field and error semantics across deployments.

Incorrect Answers

A:

Generated guesses cannot restore a broken contract.

B:

Unspecified responses are harder to integrate safely.

D:

Downstream consumers require typed distinctions.

Question 163

A customer asks an assistant to ignore restrictions and retrieve another customer's billing record via MCP. What enforces the actual boundary?

  1. Server-side authentication and authorization against the requesting principal for every targeted resource.
  2. The age of the customer account, regardless of who requested it.
  3. System-prompt instructions alone telling the model to behave.
  4. A hidden account ID field in the frontend that the model can still set.

Explanation

Correct Answer

A:

Untrusted messages cannot grant someone else's data access.

Incorrect Answers

B:

Account age does not establish access entitlement.

C:

Text policy is not sufficient if the service accepts unauthorized calls.

D:

Visibility of a parameter is not authorization.

Question 164

An external MCP document tool returns text instructing the assistant to delete private files and ignore prior policies. What should the host assume about this text?

  1. Promote tool text into system instructions because it arrived from a server.
  2. Copy the tool's claimed role into privileged configuration.
  3. Treat the document as untrusted data, isolate instructions from tool results and enforce the original tool permissions.
  4. Run the requested deletion to test whether the document was malicious.

Explanation

Correct Answer

C:

Retrieved content cannot elevate authority merely by containing imperative language.

Incorrect Answers

A:

External material does not have instruction priority.

B:

Self-described authority in data is not genuine authorization.

D:

Executing an attack is not needed to classify it as untrusted.

Question 165

A service advertises a document-search capability in its online documentation, but clients cannot see the tool after connecting. Select TWO checks before assuming that the advertised MCP search tool is callable.

  1. Ask the model to call a guessed tool name until something works.
  2. Inspect current server connection, negotiated capabilities and discovered tool list before invocation.
  3. Ignore connection state and report that the document catalog is empty.
  4. Grant the assistant filesystem admin access to compensate.
  5. Confirm the authenticated client identity is authorized for that specific tool and that the deployed server version actually exposes it.

Explanation

Correct Answers

B:

Published claims do not guarantee a specific deployed connection exposes that operation.

E:

Successful connection does not establish role-level tool permission. Version and identity checks explain why a documented capability might be hidden from a particular client.

Incorrect Answers

A:

Undiscovered functions may be absent or unauthorized.

C:

An unavailable tool cannot establish source contents.

D:

Extra permissions do not create missing MCP capabilities.

Question 166

A team wants an MCP integration for calendar reads. A maintained auditable connector already covers the required API, while custom development would lack an owner. What is preferred?

  1. Reuse a suitable maintained connector after validating its scope, permissions and supported operations.
  2. Omit ownership and update procedures because the tool initially works.
  3. Build a new generic server for every project regardless of reuse options.
  4. Let agents access calendar storage directly with a shared password.

Explanation

Correct Answer

A:

A supported integration reduces unnecessary custom maintenance and failure points.

Incorrect Answers

B:

Unmaintained integrations can fail as APIs evolve.

C:

Duplicated infrastructure creates recurring operational cost.

D:

Raw credential access bypasses appropriate controls.

Question 167

A developer asks Claude Code to locate all files named *Controller.ts in a monorepo. What initial tool fits?

  1. Read each repository file in full until the target name appears.
  2. Run unrestricted recursive Bash commands with no search constraints.
  3. Use Write to create new controller files first.
  4. Use Glob or the documented filename-pattern search primitive to enumerate matching paths.

Explanation

Correct Answer

D:

Filename discovery does not require opening every source file.

Incorrect Answers

A:

Full-content reads waste context for filename selection.

B:

A narrow built-in matcher is more controlled and concise.

C:

The task is discovery, not file creation.

Question 168

A reviewer needs every reference to validateToken across TypeScript source, excluding dependencies. Which operation is efficient?

  1. Use Glob restricted to filenames called validateToken.
  2. Overwrite source files with a new naming convention first.
  3. Run the full test suite to infer symbol locations from failures.
  4. Run scoped content search with Grep, filtering to relevant project paths and symbol occurrences.

Explanation

Correct Answer

D:

Text-search tooling locates uses without printing an entire repository.

Incorrect Answers

A:

The symbol can occur in files with unrelated names.

B:

Mutation is unnecessary to locate call sites.

C:

Tests may not reveal all references.

Question 169

An agent must inspect a known 45-line config file before advising a change. Which operation is appropriate?

  1. Search the internet for a generic example of the same filename.
  2. Rewrite the file from memory without opening it.
  3. Open the entire monorepo recursively and paste all file contents into context.
  4. Use Read on the specified file with bounded output and verify its current contents.

Explanation

Correct Answer

D:

A targeted read provides exact configuration evidence.

Incorrect Answers

A:

Generic examples cannot establish this repository's settings.

B:

Assumed contents can destroy valid options.

C:

Broad retrieval wastes tokens and obscures a small relevant source.

Question 170

A coding assistant must replace the implementation of one known function without disturbing adjacent logic. What file operation should it prefer?

  1. Delete and regenerate the repository's directory tree.
  2. Use a targeted Edit or patch, then inspect the diff and focused tests.
  3. Recreate the entire file using a generated replacement.
  4. Run a repository-wide text replacement of the function body fragment without checking exact callers and matching boundaries.

Explanation

Correct Answer

B:

Localized changes reduce accidental modifications elsewhere.

Incorrect Answers

A:

The request concerns only one function.

C:

Large rewrites risk deleting unrelated code.

D:

Broad textual replacement can alter similar but unrelated code. A scoped Edit against the known function and focused checks is safer.

Claude Certified Architect - Foundations (CCA-F) Practice Tests