Anthropic Updated CCDV-F Exam Questions and Answers by issa

Option A is the appropriate trust-boundary treatment for external content. Untrusted text can contain malformed data, adversarial instructions, prompt-injection attempts, or content deliberately constructed to alter the agent's behavior. It should therefore be validated or screened before inclusion and clearly represented as untrusted data rather than authoritative application instructions.

Anthropic's prompt-injection guidance distinguishes direct attacks from indirect prompt injection, where Claude processes third-party content such as webpages, emails, documents, or tool output containing hostile instructions. Anthropic recommends input validation and screening, least-privilege access, safe treatment of untrusted tool content, and screening content before Claude acts on it. Importantly, Anthropic notes that tool-result content is treated as untrusted data rather than as a reliable place for application instructions.

B erases the trust distinction and exposes the application to instruction/data confusion. C introduces a deliberately weaker security boundary and does not sanitize the data. D prevents legitimate use cases unnecessarily; untrusted does not mean unusable—it means the data must be handled defensively.

Therefore, A correctly combines validation with explicit trust separation. Relevant Study Guide topics: prompt injection, untrusted content, input validation, sanitization, data/instruction separation, least privilege, and defense in depth.

The supplied exam source marks D . Claude prompt caching is designed for repeated prompt prefixes, not semantic caching of generated answers. High-value cache candidates include stable system prompts, long instructions, tool definitions, shared background documents, repeated examples, and the previously accumulated prefix of a multi-turn conversation.

Anthropic explains that prompt caching reuses a matching prompt prefix and can substantially reduce processing time and input-token cost on subsequent requests. The cache operates across the request structure—tools, system content, and messages up to the relevant cache boundary. It is particularly useful for prompts with many examples, large repeated context, repetitive instructions, and long multi-turn conversations.

B describes response caching , which is a separate application-level technique and is not what Anthropic's prompt caching feature does. C targets the portion that usually changes most, making it a poor general cache boundary. A is incorrect because multi-turn workloads are a major prompt-caching use case.

Therefore, maximize reusable stable prefixes and place changing request-specific content after them where practical.

Relevant Claude Developer topics: Claude API Mechanics, prompt caching, cache prefixes, token-cost optimization, static context, system prompts, multi-turn conversations, and API efficiency .

===============

Option A is correct because sensitive-data protection must occur before prohibited information crosses the application's trust boundary. If account numbers, passwords, or other secrets must not be sent to Claude, asking Claude to “ignore” those values after transmission does not satisfy the requirement. The application must determine which data is permitted to leave its controlled environment and transform or reject prohibited content before constructing the Claude request.

This principle is consistent with Anthropic's defense-in-depth guidance. Anthropic recommends input screening, limiting Claude's access to sensitive information, and applying least privilege so the model receives only information necessary for the task.

B is fundamentally too late: the sensitive information has already been transmitted to the model context before the system instruction can influence behavior. C is worse because logging can create an additional store containing the sensitive information and only detects exposure after it occurs. D implements some boundary filtering but deliberately leaves coverage incomplete until production incidents reveal additional patterns.

Therefore, A requires the boundary and its permitted data flows to be defined first, then enforced comprehensively through filtering, redaction, tokenization, or rejection. Relevant Study Guide topics: application boundaries, data minimization, sensitive-data handling, filtering, redaction, least privilege, and privacy-preserving design.

===============

Option A correctly treats this as a context-dependent format drift problem rather than an arbitrary model failure. Because the application initially produces valid JSON and progressively loses structure over subsequent turns, the investigation should focus on how accumulated conversation history changes the instructions and examples visible to Claude. Earlier malformed outputs, conflicting instructions, tool results, or unnecessary historical content can gradually reduce adherence to the intended format.

The application should therefore inspect the conversation state, preserve the authoritative formatting requirement, prune irrelevant content where appropriate, and validate outputs at the application boundary. Anthropic's Structured Outputs capability is specifically designed to prevent malformed structured responses by constraining Claude to a supplied JSON Schema. Official guidance states that Structured Outputs provide valid, parseable, schema-compliant results for downstream processing.

B destroys the response rather than correcting the failure mode. C resets state but prevents meaningful multi-turn operation and does not diagnose why context causes drift. D changes model characteristics without establishing that the model is responsible.

The supplied question on page 12 identifies A as correct. Relevant topics: Agent Architecture, context engineering, format drift, structured outputs, context evolution, schema validation, and long-running conversations.

===============