原创声明：本卷为课程原创教学模拟题，不是、也不冒充官方真题；未使用任何 brain dump 或泄露材料。 对齐 2026-08-30 VERIFIED 的 CCAR-F 形式：60 题 / 120 分钟 / 720 及格（量表 100–1,000；720 为 scaled score，无法换算为原始分百分比，官方仅看量表）。题型 Multiple-choice + Multiple-response（多选显式标注选择数量）；官方卷含 4 个 scenario 题（抽自 6 场景库），本卷同样内置 4 道场景题。来源：官方 Exam Guide + Skilljar 认证页（见 ../00-certification-current-status/certification-status.md 核验小节，截至 2026-08-30）。 域配比按官方 VERIFIED 权重：Agentic Architecture & Orchestration 27%（16 题）/ Claude Code Configuration & Workflows 20%（12 题）/ Prompt Engineering & Structured Output 20%（12 题）/ Tool Design & MCP Integration 18%（11 题）/ Context Management & Reliability 15%（9 题）。域名为官方原文。
Q1. An accounts-payable pipeline assigns each incoming invoice to one of 15 fixed general-ledger account codes. Input is structured, business rules are stable, and the mapping rarely changes. Which architecture should the team choose? (Agentic Architecture & Orchestration) A. A multi-agent system with a coordinator and one worker agent per account code B. A single-call workflow: one LLM call with structured output constraining the answer to the 15-code enum C. An open-ended agent loop that lets the model devise its own classification strategy per invoice D. An evaluator-optimizer loop that rewrites each classification until a reviewer agent is satisfied
Q2. According to Anthropic's guidance on building effective agents, the core activities of an operating agent loop are best described as: (Agentic Architecture & Orchestration) A. Plan → commit → roll back B. Retrieve → rank → generate C. Gather context → take action → verify results, repeating until a stopping condition D. Summarize → cache → respond
Q3. In the Messages API, a model response arrives with stop_reason: "tool_use". What must your application do next? (Agentic Architecture & Orchestration) A. Treat the turn as complete and return the text to the user B. Retry the request because the output was truncated by max_tokens C. Strip the tool call and regenerate the answer with a stricter system prompt D. Execute the requested tool(s), then send the results back in a new request as tool_result content blocks
Q4. During a production-readiness review of a new agent loop, which missing element is a release blocker? (Agentic Architecture & Orchestration) A. The agent does not use subagents for exploration B. The agent has no stopping conditions such as max iterations or a spend budget C. The agent is not connected to any MCP servers D. The agent does not stream its output to the user
Q5. Which statement about multi-agent systems matches Anthropic's guidance? (Agentic Architecture & Orchestration) A. They cost roughly 15× the tokens of a single agent and are justified only when the task is open-ended, parallelizable, exceeds a single context window, and carries high value B. They are cheaper than single agents and should be the default for any task C. They cost about 2× and only require two or more user groups D. They add no cost as long as a stronger model is used
Q6. In a coordinator-subagent architecture, what should a subagent return to the main conversation when it finishes? (Agentic Architecture & Orchestration) A. Its full raw context and every tool output it produced B. A distilled summary of its findings — the practical implementation of context isolation C. Direct control instructions for the next subagent D. Only its final stop_reason value
Q7. A support platform routes simple password-reset questions to a fast, inexpensive model tier and complex incident analyses to a stronger tier. Which orchestration pattern is this? (Agentic Architecture & Orchestration) A. Routing B. Chaining C. Parallelization D. Evaluator-optimizer
Q8. A document pipeline always performs the same fixed sequence: extract fields → validate → translate → format. Each step's output feeds the next. This is best built as: (Agentic Architecture & Orchestration) A. A multi-agent debate system B. An open-ended agent loop C. One monolithic prompt with no intermediate validation D. A prompt chain orchestrated by deterministic code
Q9. Parallelization (running prompts on several chunks, or several model votes) delivers its main benefit when: (Agentic Architecture & Orchestration) A. The subtasks are independent and you want lower wall-clock latency or better consistency via voting B. The task must follow one strictly ordered sequence C. The model must choose its own tools dynamically D. You primarily need to reduce total token cost
Q10. Which task is the best fit for an evaluator-optimizer loop? (Agentic Architecture & Orchestration) A. One-shot invoice classification into a fixed enum B. A fixed 5-step ETL pipeline C. Literary translation where a rubric can grade drafts and iteration measurably improves quality D. Factual lookup from a single table
Q11. In the Agent SDK / Claude Code hooks model, which statement about PreToolUse hooks is correct? (Agentic Architecture & Orchestration) A. They run after a tool has already executed, for logging only B. They run before tool execution and can deterministically block the call, independent of what the model decides C. They rewrite the model's system prompt at session start D. They are advisory suggestions the model may ignore
Q12.（Select TWO) Which TWO situations justify a multi-agent architecture? (Agentic Architecture & Orchestration) A. A fixed nightly ETL job whose steps never change B. Open-ended research across dozens of sources whose relevant set cannot be predicted and whose volume exceeds one context window C. A single classification call with a stable enum D. High-value analysis where independent sub-investigations can run in parallel and be merged
Q13.（Select THREE) Which THREE of the following are named orchestration patterns (deterministic workflows) in Anthropic's taxonomy? (Agentic Architecture & Orchestration) A. Routing B. Prompt chaining C. An unbounded self-directed agent loop D. Evaluator-optimizer
Q14.（Select THREE) Which THREE are valid stopping conditions for a production agent loop? (Agentic Architecture & Orchestration) A. Maximum iteration count B. Token or spend budget cap C. Wall-clock timeout D. "The model believes the task is done" with no external limit
Q15.【Scenario: Automation boundary for a booking assistant】 (Agentic Architecture & Orchestration) Scenario: A travel company's assistant handles itinerary-change requests. Policy: changes costing ≤ $150 with no fraud flags may be auto-applied; anything above $200 or with risk flags requires human approval. Auditors must be able to replay the decision basis for every change. Constraints: minimal tool surface; the model's output is advisory only; every executed change needs a replayable record. Options: A. Give the agent a generic SQL tool over the bookings database and encode the dollar rules in the prompt B. Deterministic policy engine gates execution (amount/fraud rules → auto-apply low risk, route high risk to an approval queue); the LLM drafts the recommendation and the human-handoff summary C. Let the model output "approve/deny" per request and execute its decision unconditionally D. Drop the LLM entirely; humans handle everything through forms
Q16.【Scenario: Research agent pollutes its own context】 (Agentic Architecture & Orchestration) Scenario: A long-horizon research agent browses many web sources. After 40+ minutes, answer quality drops: early constraints are ignored and raw page content floods the context; cost runs 3× budget. Constraints: the task genuinely requires broad open-ended exploration; feature scope cannot be cut; the main session must keep a clean task state. Options: A. Move everything into CLAUDE.md so nothing is lost B. Switch to a 1M-token flagship model and keep the full history C. Dispatch bulk read-only exploration to an explore subagent that returns distilled findings; the main session keeps only task state and summaries D. Run /clear every ten turns and restart from scratch
Q17. In Claude Code, CLAUDE.md is best described as: (Claude Code Configuration & Workflows) A. A hard configuration file — violations are automatically blocked B. A permission allow-list for tools C. Context/instructions provided to the model; enforcement requires separate mechanisms such as deny rules and hooks D. An equivalent of managed settings
Q18. An organization uses all four configuration layers, and two layers define conflicting values for the same setting. Which layer wins? (Claude Code Configuration & Workflows) A. Managed policy (organization-level managed settings) B. User-level settings C. Project-level settings D. Local settings
Q19. Security requires that dangerous shell commands (e.g., rm -rf on system paths) are blocked no matter what the model decides. The correct implementation is: (Claude Code Configuration & Workflows) A. A prohibition written in CLAUDE.md B. A prohibition written in the system prompt C. Trusting the model's judgment D. permissions.deny rules plus a PreToolUse hook that blocks the call (non-zero exit code)
Q20. Which statement about plan mode is correct (per current docs, as of 2026-08-30)? (Claude Code Configuration & Workflows) A. Plan mode is a separate product page unrelated to permissions B. Plan mode is a permission mode: read-only exploration plus a plan produced for human approval before execution C. In plan mode, deny rules are ignored D. acceptEdits auto-accepts every Bash command
Q21. Which is true of permissions.deny rules? (Claude Code Configuration & Workflows) A. They apply in every permission mode, including bypassPermissions B. They only apply in default mode C. They can be overridden by a polite system prompt D. They are soft guidance for the model
Q22. An enterprise wants org-wide Claude Code security baselines that individual developers cannot turn off. These belong in: (Claude Code Configuration & Workflows) A. Each repository's CLAUDE.md B. Each user's personal settings C. Organization managed settings / managed policy — highest precedence and lockable D. A shared team wiki page
Q23. An old tutorial says "create custom slash commands". Per current docs (as of 2026-08-30), the correct understanding is: (Claude Code Configuration & Workflows) A. Custom commands and Skills are two parallel mechanisms B. Custom commands have been folded into Skills — Skills are the current concept C. Custom commands were removed with no replacement D. Skills only work in headless mode
Q24. A CI job runs claude -p (headless) on every pull request. What should the permission posture be? (Claude Code Configuration & Workflows) A. bypassPermissions, for speed B. No configuration — defaults are safe enough C. Ask a human to confirm each step interactively D. Tighter than interactive use: minimal allow-list plus deny rules and hook enforcement
Q25. The primary architectural benefit of Claude Code subagents is: (Claude Code Configuration & Workflows) A. They run in a separate context window with their own least-privilege tool access — context isolation plus privilege scoping B. They make the model smarter C. They remove the need for permissions D. They share the main session's full context by design
Q26.（Select TWO) Which TWO pairings correctly match the mechanism to the goal? (Claude Code Configuration & Workflows) A. Coding-style preferences → CLAUDE.md guidance B. Block all reads of ./secrets/** → permissions.deny rule C. "Never push to main" → write it in CLAUDE.md and rely on the model D. Enforce PII redaction → ask politely in the system prompt
Q27.（Select THREE) Which THREE are sound context-management practices inside Claude Code? (Claude Code Configuration & Workflows) A. Dispatch large read-only exploration to a subagent that returns a summary B. Keep CLAUDE.md concise (official guidance: around 200 lines or less) C. Use /compact on long sessions, accepting that summarization is lossy D. Paste every build log into CLAUDE.md so nothing is lost
Q28.【Scenario: Organization-wide Claude Code rollout】 (Claude Code Configuration & Workflows) Scenario: A company rolls out Claude Code across 40 repositories. Requirements: (1) a secrets/ directory present in every repo must never be read by Claude; (2) risky refactors on payment services require a human to review the plan before execution; (3) repeated onboarding workflows should be packaged for reuse. Constraints: individual developers must not be able to weaken requirement (1); rollout cannot block all autonomy on low-risk repos. Options: A. Put all rules in each repo's CLAUDE.md and trust the model B. Managed settings with deny on Read(./secrets/**) org-wide plus a PreToolUse hook; plan mode followed by human review for risky refactors; onboarding workflows packaged as Skills C. Grant every developer bypassPermissions and audit outputs after the fact D. Forbid Claude Code on payment repositories and keep the rules in a wiki
Q29. What does schema-constrained structured output guarantee? (Prompt Engineering & Structured Output) A. Both format validity and semantic correctness B. Semantic correctness only C. Nothing — it is best-effort D. Format/structure validity only (constrained decoding); semantic correctness must be verified by evaluation
Q30. A downstream parser keeps receiving invalid JSON. Which approach is the MOST reliable fix? (Prompt Engineering & Structured Output) A. Schema-constrained structured output (or strict tool use), so the decoder cannot emit schema-invalid tokens B. Adding "Always output valid JSON" to the prompt C. Prefilling the first token of the JSON D. Raising temperature for more varied attempts
Q31. Which is the LEAST reliable approach to getting parseable JSON? (Prompt Engineering & Structured Output) A. Instructing the model in the prompt to "always output valid JSON" B. Structured output with a JSON schema C. Strict tool use with schema-validated parameters D. A repair-retry loop on validation failure
Q32. A repair-retry loop for structured outputs works by: (Prompt Engineering & Structured Output) A. Silently discarding failed outputs B. Restarting the whole session on any error C. Feeding the validator's error message back to the model so it can fix its previous output D. Lowering temperature until errors disappear
Q33. A common few-shot prompting mistake is: (Prompt Engineering & Structured Output) A. Using 3–5 examples B. Including edge cases in the examples C. Keeping examples in the target domain D. Making every example identical in format and success-only, so the model overfits example artifacts instead of learning the task
Q34. Per current API behavior (as of 2026-08-30), using assistant-prefill to force an output format: (Prompt Engineering & Structured Output) A. Is the recommended way to constrain JSON B. Is deprecated on newer models (requests return 400); migrate to structured output plus adaptive thinking C. Is still required for all structured output D. Is unrelated to formatting
Q35. The Message Batches API is best characterized as: (Prompt Engineering & Structured Output) A. A low-latency synchronous endpoint B. A streaming upgrade C. Usable only for evaluations D. An offline cost lever: roughly 50% cheaper, results within a 24-hour window, no streaming
Q36. For prompt caching efficiency, the request prefix should be organized so that: (Prompt Engineering & Structured Output) A. Stable content (system prompt, tool definitions) comes first and stays identical across requests B. Volatile per-request content comes first C. Message order is randomized to avoid bias D. Prefix structure does not matter for caching
Q37. Wrapping distinct prompt sections in XML-style tags (e.g., <instructions>, <document>) primarily helps because: (Prompt Engineering & Structured Output) A. It encrypts the prompt B. It reduces those sections' token count to zero C. It gives the model unambiguous structural boundaries between instructions, data, and examples D. It disables caching
Q38. Adding clear natural-language descriptions to each field of a JSON schema typically: (Prompt Engineering & Structured Output) A. Worsens accuracy by adding tokens B. Is ignored by the model C. Only affects input cost D. Improves output accuracy because the model understands what each field means and when to use it
Q39.（Select THREE) Which THREE statements about schema-constrained structured output are correct? (Prompt Engineering & Structured Output) A. It guarantees the factual accuracy of the values inside the JSON B. Constrained decoding eliminates format-invalid outputs C. Semantic correctness still requires an evaluation pipeline D. It can be combined with a repair-retry loop for residual validation issues
Q40.（Select TWO) Which TWO workloads fit the Message Batches API? (Prompt Engineering & Structured Output) A. Nightly enrichment of 100,000 product catalog rows B. An offline eval suite of 1,500 golden cases C. An interactive chat that streams tokens to a user D. A payment-authorization decision needed in under two seconds
Q41. In MCP, which mapping of primitives to "who controls invocation" is correct? (Tool Design & MCP Integration) A. tools = model-controlled; resources = application-driven; prompts = user-controlled B. tools = application-driven; resources = model-controlled; prompts = host-controlled C. All three are model-controlled D. All three are server-controlled
Q42. In the MCP architecture, which component owns the conversation history, orchestration, and user consent? (Tool Design & MCP Integration) A. Any client B. The transport layer C. The host application D. The server
Q43. An agent calls an MCP tool with an invalid record ID. Per MCP design guidance, the server should: (Tool Design & MCP Integration) A. Return a tool result with isError: true plus an actionable message so the model can self-correct; reserve JSON-RPC errors for protocol-level failures B. Always raise a JSON-RPC protocol error C. Return an empty successful result D. Terminate the agent session
Q44. Which MCP deployment practice is explicitly forbidden by the specification? (Tool Design & MCP Integration) A. stdio transport for local servers B. Token passthrough — forwarding a user's upstream token verbatim to downstream services C. Origin header validation D. Progressive disclosure of tools
Q45. A local MCP server listening on localhost over HTTP is exposed to DNS-rebinding attacks. The recommended defense is: (Tool Design & MCP Integration) A. Binding to 0.0.0.0 with no authentication B. Validating the Origin header and rejecting requests from unexpected origins C. A longer API token D. Switching to stdio, which guarantees safety in all cases
Q46. A team connects an agent to 60 MCP tools; selection accuracy drops and costs rise. The recommended direction is: (Tool Design & MCP Integration) A. Rename all tools to shorter names B. Upgrade to a bigger-context model — it solves the problem permanently C. Progressive discovery / tool search: expose a tool catalog in context and load full definitions on demand D. Delete half the business features
Q47. MCP most directly solves which integration problem? (Tool Design & MCP Integration) A. The N-tools × M-clients matrix: one standard protocol instead of N×M bespoke integrations B. Making models smarter C. Replacing all REST APIs permanently D. Eliminating the need for tool permissions
Q48. Per Anthropic's engineering guidance, investing in tool descriptions and interfaces (ACI) pays off because: (Tool Design & MCP Integration) A. Tool count matters more than quality B. Descriptions only matter for small models C. Longer descriptions always help D. Well-documented tools reduce misuse more cheaply than prompt tuning; time spent on tools often exceeds prompt tuning
Q49.（Select TWO) Which TWO follow the correct MCP resource/tool split? (Tool Design & MCP Integration) A. Read-only reference data (files, schemas, directory listings) → resources B. Operations that change system state → tools C. Make everything a tool for simplicity D. Resources can execute write operations
Q50.（Select TWO) Which TWO transport choices are correct for MCP servers? (Tool Design & MCP Integration) A. stdio across the WAN, for security B. stdio for local servers C. Raw TCP sockets as the recommended default D. Streamable HTTP for remote servers
Q51.【Scenario: Ticket-lookup MCP server error semantics】 (Tool Design & MCP Integration) Scenario: Your agent queries an internal "ticket lookup" MCP server. Invalid ticket IDs currently surface as JSON-RPC protocol errors and crash the agent session; some failures ("permission denied for this queue") are actually recoverable. You may change the server's error-mapping layer but not its business logic. Constraints: the model should get a chance to self-correct (fix format, pick another queue); protocol-level failures must remain distinguishable; no silent failures. Options: A. Treat every failure as a protocol error and fail fast B. Map business failures (invalid ID, no record, permission denied) to tool results with isError: true and actionable messages; reserve JSON-RPC errors for protocol-level failures C. Catch everything and return an empty successful result D. Route every error to a human agent
Q52. The context window is best understood as: (Context Management & Reliability) A. Permanent long-term storage for everything the model has seen B. A cache that never degrades C. Working memory: recall degrades as the window fills (context rot); more tokens ≠ better recall D. A database with guaranteed lookups
Q53. The "lost in the middle" effect implies that prompt designers should: (Context Management & Reliability) A. Place critical instructions and facts at the start and end of the context, not buried mid-context B. Always maximize context length C. Put key instructions in the middle, where attention is claimed to be highest D. Ignore position entirely
Q54. In long-running agent sessions, progressive summarization means: (Context Management & Reliability) A. Never summarizing anything B. Repeating the entire history every turn C. Raising temperature to stay creative D. Periodically compressing older exchanges into a summary that preserves key facts and constraints, keeping recent detail intact
Q55. A good escalation (hand-off to a human) includes: (Context Management & Reliability) A. A one-line message: "please handle this" B. Structured context: the original request, what was attempted, relevant state, and a trace ID C. Only the customer's name D. Nothing — the human will figure it out
Q56. For regulated workflows, provenance/attribution in generated answers means: (Context Management & Reliability) A. The model signs its name to the output B. Marking answers as AI-generated is sufficient C. Each material claim links to a retrievable source (citations), so decisions are auditable D. Keeping prompts secret from auditors
Q57. In a fallback chain (primary model → backup model → static response), the trigger for switching should be defined: (Context Management & Reliability) A. In application code with explicit conditions — not left to the model's discretion B. In the system prompt, letting the model decide when to fall back C. By the vendor, automatically D. Nowhere — fallbacks are unnecessary in production
Q58.（Select THREE) Which THREE practices help fight context rot? (Context Management & Reliability) A. Curating only task-relevant material into the window B. Retrieving just-in-time instead of preloading everything C. Persisting key facts as structured notes and reloading a compact state D. Always including the full conversation history to maximize available context
Q59.（Select TWO) Which TWO describe sound human-in-the-loop approval design? (Context Management & Reliability) A. Require approval after every generated sentence B. Place approval gates at irreversible or high-impact actions C. Keep approval volume low so reviewers stay engaged (guard against approval fatigue) D. Batch-approve everything at the end of the day
Q60.（Select THREE) Which THREE are sound reliability patterns for Claude-backed services? (Context Management & Reliability) A. Exponential backoff with jitter on retryable errors B. A circuit breaker to stop hammering a failing dependency C. A timeout budget allocated top-down across call layers D. On 529 (overloaded), immediately doubling concurrent retries
（Mock 01 完） · 对答案：mock-01-answers.md · 下一套：mock-02.md
来源：考试形式与域权重 = 官方 Exam Guide + Skilljar 认证页（VERIFIED，截至 2026-08-30，见 ../00-certification-current-status/certification-status.md）；题目技术内容 = 本课程模块 M01–M13 原创。📚 目录