Question Bank — Domain 2: Tool Design & MCP Integration

24 items. 18% of the exam (~11 items).

Block A — Tool design and selection (items 1–10)

1

An agent has two tools, analyze_content and analyze_document. It uses them interchangeably, often choosing the wrong one. Both descriptions read "Analyze the provided content and return insights." What is the most effective first step?

A. Rewrite both descriptions with explicit boundaries stating what each handles and what it does not, referring to the other tool.
B. Merge them into a single analyze tool.
C. Add a system prompt instruction telling the model when to use each.
D. Rename them to analyze_text and analyze_pdf.

Answer

Tool descriptions are the primary selection mechanism. Two identical descriptions give the model nothing to discriminate on. Explicit boundaries — "does not handle X; use Y for that" — are the direct fix.

B — Discards a real capability distinction. Might be right if the tools genuinely did the same thing; the stem implies they don't.
C — System prompt guidance is weaker than the description the model actually reads at selection time, and it doesn't scale as tools are added.
D — Renaming without updating the descriptions. Better names help marginally, but both descriptions still read "Analyze the provided content and return insights," so the model has nothing new to discriminate on. Half-right.

⚠️ Don't over-learn D. Renaming is weak only because this option leaves the descriptions untouched. Renaming plus a scope-specific description is a remedy the guide prescribes by name — its own example is renaming analyze_content to extract_web_results with a web-specific description to eliminate functional overlap. If an option offers rename and re-describe, that is a correct answer, not a distractor. See Chapter 05 §2.

Reflex 3.

2

A single analyze_document tool is used for extracting figures, summarizing, and fact-checking. Quality is poor across all three. Best fix?

A. Add detailed instructions to the tool description covering all three use cases.
B. Split it into extract_data_points, summarize_content, and verify_claim_against_source.
C. Add a mode parameter with three allowed values.
D. Increase the tool's output token limit.

Answer

Three genuinely different jobs. Splitting gives each a focused description, a purpose-built schema, and independent selection.

A — A description covering three jobs is the problem, not the fix.
C — Keeps one tool with three behaviours. Selection improves slightly (the model must choose a mode) but the schema still has to serve all three, and the description still describes three things. Plausible but inferior — the exam prefers the split.
D — Unrelated.

3

An agent has a well-described verify_fact tool but consistently uses web_search instead. Descriptions are clear and non-overlapping. What should be audited next?

A. The system prompt, for keyword-sensitive instructions steering the model toward search.
B. The verify_fact tool's output schema.
C. Whether verify_fact appears before web_search in the tools array.
D. The model's temperature setting.

Answer

When descriptions are sound, the next place selection pressure comes from is the system prompt. An instruction like "always search for current information" will pull the model to web_search regardless of the tool descriptions.

B — Output schema doesn't affect selection.
C — Tool order is not a documented selection mechanism; treating it as one is a distractor.
D — Temperature affects variability, not systematic misrouting.

4

After a team grew an agent's tool count from 5 to 18, selection accuracy dropped noticeably. Which two responses are appropriate? (Select two.)

A. Consolidate overlapping tools and remove ones that are rarely used.
B. Scope tools per agent so each has only what its role requires.
C. Add a system prompt section listing all 18 tools and when to use each.
D. Force tool_choice: "any" so the model always commits to a tool.

Answer

A and B.

Both reduce the candidate set the model must discriminate across. The exam's figure: 18 tools instead of 4–5 degrades selection.

C — Duplicates the descriptions in a less effective location and adds context on every call.
D — Forces tool use without improving which tool. If anything it removes the option of not calling a tool.

5

Analysis shows 85% of analyze_document calls are a single narrow task: checking whether a specific claim is supported by a source. The remaining 15% vary. Best design?

A. Add a scoped verify_claim_against_source tool for the common case and keep the general tool for the rest.
B. Keep the single general tool and improve its description.
C. Replace the general tool entirely with the scoped one.
D. Add a task_type enum to the general tool.

Answer

Scope the common case; keep a route for the exception. The 85% gets a purpose-built tool with a precise schema, and nothing is lost.

B — Leaves the dominant case served by a general-purpose tool that's easy to misuse.
C — Drops 15% of capability. Over-correction.
D — Better than nothing but keeps one tool with a diffuse description.

6

Agents pass arbitrary, sometimes malformed URLs to a fetch_url tool and receive unusable content. What is the appropriate change?

A. Replace fetch_url with a load_document tool that validates and normalizes its input and returns structured content.
B. Add a prompt instruction to only pass well-formed URLs.
C. Add retry logic to fetch_url.
D. Return an empty result when the URL is malformed.

Answer

Move validation into the tool. The tool boundary is the deterministic place to enforce input shape and return something usable.

B — Probabilistic guidance for an input-validation problem.
C — Retrying a malformed URL fails identically.
D — Reports a validation failure as "nothing found." Reflex 6 violation.

7

Which tool_choice setting forces the model to call one specific tool?

A. "auto"
B. "any"
C. {"type": "tool", "name": "extract_invoice"}
D. {"type": "forced", "tool": "extract_invoice"}

Answer

A — Model decides whether to use a tool at all.
B — Must use some tool, its choice which.
D — Not a real form.

8

Which elements belong in a tool description to support correct selection? (Select three.)

A. Accepted input formats and required prefixes.
B. Example queries the tool is appropriate for.
C. Explicit boundaries — what the tool does not handle, and which tool does.
D. The tool's average latency and cost per call.

Answer

A, B, and C.

D — Performance characteristics aren't selection information in the exam's framing, and performance benchmarking is out of scope.

9

Each subagent in a multi-agent system is given the full set of twelve tools "for flexibility." Which two problems does this create? (Select two.)

A. Reduced tool-selection accuracy within each subagent.
B. Violation of least privilege — subagents can take actions outside their role.
C. Increased likelihood of subagents communicating directly with each other.
D. Higher latency on tool discovery at connection time.

Answer

A and B.

More candidates means more misrouting, and a research subagent holding process_refund can do things it should never do.

C — Tool access doesn't create a communication channel; topology is a separate concern.
D — Not a documented consequence and not what the exam tests.

10

An MCP-provided search_codebase tool is consistently ignored in favour of the built-in Grep, even where search_codebase would be better. What is the fix?

A. Enhance the MCP tool's description to state explicitly what it does that Grep cannot.
B. Remove Grep from the agent's allowed tools.
C. Set the MCP tool as preferred in .mcp.json.
D. Add the MCP tool twice so it appears more prominent.

Answer

Selection is description-driven. If search_codebase offers semantic matching or cross-repository scope, the description has to say so.

B — Removing a genuinely useful built-in to force selection. Over-correction, and Grep remains the right tool for literal searches.
C — No such option exists.
D — Not a mechanism.

Block B — MCP, errors, built-ins (items 11–20)

11

A team wants all developers on a repository to share the same MCP server configuration, including one that needs an API token. What is correct?

A. Commit .mcp.json at the repo root with the token referenced as ${JIRA_API_TOKEN}.
B. Commit .mcp.json with the token value inline, and restrict repository access.
C. Have each developer add the server to ~/.claude.json.
D. Commit ~/.claude.json to the repository.

Answer

.mcp.json is the project-level, committed configuration. ${ENV_VAR} expansion lets you share the config without sharing the secret.

B — Commits a credential. Never correct.
C — Works but isn't shared — every developer configures it manually, and it drifts.
D — ~/.claude.json is user-level and outside the repository; it also holds unrelated personal config.

12

A document-search tool returns [] with isError: false when the caller lacks permission on a collection. The final research report states that no internal documents exist on the topic. What is wrong?

A. The synthesis agent should have verified the claim before including it.
B. The tool reports an access failure as a valid empty result; it should return isError: true with a permission category.
C. The coordinator should have retried the search.
D. The report should have included a confidence score for the claim.

Answer

An access failure is not a valid empty result. Because the tool reported success, nothing downstream could know the difference between "we looked and found nothing" and "we couldn't look."

A — Downstream verification can't recover information the tool concealed.
C — Retrying a permission failure fails identically — and the agent doesn't know there was a failure.
D — A confidence score on a false premise is still false.

Reflex 6. This is the highest-value item in the domain.

13

Which error categories should be marked non-retryable? (Select two.)

A. transient
B. validation
C. business
D. permission

Answer

C and D.

Business-rule violations and permission denials do not change on retry.

A — Retryable by definition.
B — Retryable after correcting the input — the model can fix a malformed ID and try again. Not in the same class as C and D.

14

A refund is requested for an order shipped 139 days ago; policy allows 90. What should the tool return?

A. isError: true, errorCategory: "business", isRetryable: false, with the reason and the escalation alternative.
B. isError: true, errorCategory: "validation", isRetryable: true.
C. isError: false with a message explaining the policy.
D. isError: true with a generic "refund not permitted" message.

Answer

Category, retryability, a specific reason, and an alternative — the four elements of structured error context. The agent can then explain the situation and route to escalation.

B — Misclassified. The input was valid; the policy prohibits the action. Marking it retryable wastes turns.
C — A failure reported as success.
D — Correct flag, useless payload. The agent can't tell whether to retry or what to do instead.

15

A research subagent cannot access one of four document collections. Three succeed. What should it return to the coordinator?

A. The three successful result sets, plus a structured error describing the fourth: category, what was attempted, and suggested alternatives.
B. A generic "search unavailable" error, so the coordinator knows something failed.
C. Only the three successful result sets, since partial success is still success.
D. An error that terminates the research workflow.

Answer

Recover what you can locally, propagate what you can't with partial results attached.

B — Hides category, retryability, scope, and what succeeded.
C — Silent suppression. The coordinator builds a report with an undisclosed gap.
D — Terminating on one component's failure discards three successful streams. The symmetric anti-pattern.

16

Find every React component test file in a repository. Which tool?

A. Glob with **/*.test.tsx
B. Grep for describe(
C. Read on the test directory
D. Bash with find . -name "*.test.tsx"

Answer

Glob matches file paths. This is exactly its job.

B — Grep searches contents; it would miss files using a different test idiom and match non-test files that contain the string.
C — Read operates on files, and tests aren't confined to one directory.
D — Works, but reaching for Bash when a purpose-built tool exists is the wrong instinct — and the exam tests the Grep/Glob distinction directly.

17

An agent needs to change a variable name that appears four times in a file. Which approach?

A. Edit with the variable name as the anchor.
B. Read the file, then Write the full updated contents.
C. Grep then Edit.
D. Bash with sed -i.

Answer

Edit requires a unique anchor. Four occurrences means no unique anchor, so Read + Write is correct.

A — Fails or edits the wrong occurrence.
C — Grep locates it; the edit still has no unique anchor.
D — Bypasses the file tools with an unreviewable in-place mutation.

18

An agent must understand an unfamiliar 200-file codebase to plan a refactor. Most efficient approach?

A. Read every file to build a complete picture.
B. Grep for entry points, then Read selectively to follow the imports.
C. Glob for all source files and Read the twenty largest.
D. Ask the model to describe the typical structure of this kind of application.

Answer

Targeted discovery. Entry points anchor the structure; following imports traverses only what matters.

A — Fills context with irrelevant files and causes context degradation.
C — File size is a poor proxy for importance.
D — This is the context-degradation failure mode: generic patterns instead of the actual code.

19

A team needs Jira integration for their agent. What does the exam prefer?

A. Use an existing community MCP server for Jira.
B. Build a custom MCP server wrapping the Jira REST API.
C. Give the agent Bash access and let it call curl.
D. Deploy a self-hosted MCP gateway in front of Jira.

Answer

Standard third-party integrations → community MCP servers. Build custom only for your own internal systems.

B — Unnecessary work for a solved problem.
C — No schema, no descriptions, no error semantics. Loses everything MCP provides.
D — Infrastructure. Deploying and hosting MCP servers is explicitly out of scope.

20

When are tools from an MCP server discovered, and how are they available afterwards?

A. Discovered at connection time; all discovered tools are then simultaneously available.
B. Discovered on first use; each must be enabled individually.
C. Discovered per request, based on the prompt's content.
D. Discovered at connection time, but only the first ten are loaded.

Answer

B, C, D — All invent mechanisms. D in particular attaches a fake limit to a true first clause — a common distractor shape.

21

A data-extraction agent has an extract_metadata tool plus three enrichment tools. The metadata must be extracted before any enrichment runs, because enrichment depends on the document type it returns. The prompt says "always call extract_metadata first," but roughly one run in twenty skips it. Best fix?

A. Set tool_choice to force extract_metadata on the first request, then relax to auto and handle the enrichment steps in follow-up turns.
B. Set tool_choice: "any" so the model must always call a tool.
C. Restate the ordering requirement more emphatically, in capitals, at the end of the system prompt.
D. Force extract_metadata with tool_choice on every request in the conversation.

Answer

Forced selection makes the first call deterministic — the model has no option to skip it. Relaxing to auto afterwards lets it choose the enrichment tools and eventually stop. This is the guide's named pattern: force the prerequisite first, process subsequent steps in follow-up turns.

B — Guarantees a tool call, not which one. The model could open with an enrichment tool.
C — Prompt instructions have a non-zero failure rate; that's the failure being reported. Emphasis doesn't make a probabilistic mechanism deterministic. Reflex 1.
D — The model must then call a tool on every turn forever, so the loop can never terminate.

Reflex 1.

22

A document-processing pipeline holds four extraction schemas, one per document type. Incoming documents arrive unlabelled, so the type isn't known before the call. Which tool_choice setting?

A. {"type": "any"}
B. {"type": "auto"}
C. {"type": "tool", "name": "extract_invoice"}
D. Omit tool_choice and instruct the model in the prompt to always return JSON.

Answer

any guarantees structured output while letting the model select the schema that fits the document it actually received. This is the guide's stated mapping for unknown document type with multiple schemas.

B — auto permits a plain-text reply, so structured output isn't guaranteed.
C — Asserts a document type you haven't determined. Invoices get parsed correctly; everything else gets forced through the wrong schema.
D — Prompt-only JSON is the thing tool use exists to replace; it reintroduces syntax errors.

Reflex 1.

23

A research agent has analyze_content and analyze_document. Both handle real, distinct jobs — analyze_content processes web search results, analyze_document processes uploaded PDFs — but the coordinator routes web results to analyze_document about a third of the time. Both descriptions are generic. Most effective fix?

A. Rename analyze_content to extract_web_results and rewrite its description to be web-specific.
B. Rename the two tools to analyze_a and analyze_b so they're clearly distinct strings.
C. Split analyze_document into three purpose-specific tools.
D. Merge both into one analyze tool with a source_type parameter.

Answer

This is the guide's own worked example. The tools aren't doing plural jobs, so splitting is the wrong shape; the problem is that neither name nor description marks the boundary. Renaming to reflect the actual scope and re-describing it to match eliminates the functional overlap.

B — Renaming without re-describing. Distinct strings, identical semantics; the model still has nothing to discriminate on. This is the trap: rename alone is weak, rename plus re-describe is the remedy.
C — analyze_document isn't the overlapping one, and the stem says it has a single coherent purpose.
D — Discards a real capability distinction and makes selection an argument-choice problem instead of a tool-choice one.

Reflex 3.

24

A legacy service calls a third-party payment provider through an internal wrapper module. You need every place in the codebase where the provider is used. Grepping for the provider's name returns four hits, all inside the wrapper file itself. Most effective next step?

A. Read the wrapper to identify all of its exported names, then Grep for each exported name across the codebase.
B. Conclude the provider is used in exactly those four places.
C. Grep for the wrapper module's filename to find every file that imports it.
D. Read every file in the codebase to guarantee nothing is missed.

Answer

The guide's named two-step procedure. A wrapper exists to hide the underlying name, so the provider's name appears only inside it. Callers reference the wrapper's exported symbols — so you must first learn what those symbols are, then search for each one.

B — The exact wrong conclusion. Those four hits are the wrapper's own internals, not the usage set.
C — Finds import statements but not the invocation sites, and misses re-exports entirely. Half a step.
D — Floods context (Domain 5) and is unnecessary; a targeted grep per symbol is both cheaper and more complete.

Reflex 6.

Scoring

Score	Read
22–24	Strong.
18–21	Solid; re-read Chapter 06 on the misses.
13–17	Re-read Chapters 05–06 fully.
< 13	Re-study before moving on. Items 12 and 15 in particular carry the domain's central ideas.