CCAR-F Claude Certified Architect — Foundations

Question Bank — Domain 2: Tool Design & MCP Integration

20 items. 18% of the exam (~11 items).

Block A — Tool design and selection (items 1–10)

1

An agent has two tools, analyze_content and analyze_document. It uses them interchangeably, often choosing the wrong one. Both descriptions read "Analyze the provided content and return insights." What is the most effective first step?

  • A. Rewrite both descriptions with explicit boundaries stating what each handles and what it does not, referring to the other tool.
  • B. Merge them into a single analyze tool.
  • C. Add a system prompt instruction telling the model when to use each.
  • D. Rename them to analyze_text and analyze_pdf.
Answer

A.

Tool descriptions are the primary selection mechanism. Two identical descriptions give the model nothing to discriminate on. Explicit boundaries — "does not handle X; use Y for that" — are the direct fix.

  • B — Discards a real capability distinction. Might be right if the tools genuinely did the same thing; the stem implies they don't.
  • C — System prompt guidance is weaker than the description the model actually reads at selection time, and it doesn't scale as tools are added.
  • D — Renaming without describing. Better names help marginally; the descriptions are still indistinguishable. Half-right.

Reflex 3.

2

A single analyze_document tool is used for extracting figures, summarizing, and fact-checking. Quality is poor across all three. Best fix?

  • A. Add detailed instructions to the tool description covering all three use cases.
  • B. Split it into extract_data_points, summarize_content, and verify_claim_against_source.
  • C. Add a mode parameter with three allowed values.
  • D. Increase the tool's output token limit.
Answer

B.

Three genuinely different jobs. Splitting gives each a focused description, a purpose-built schema, and independent selection.

  • A — A description covering three jobs is the problem, not the fix.
  • C — Keeps one tool with three behaviours. Selection improves slightly (the model must choose a mode) but the schema still has to serve all three, and the description still describes three things. Plausible but inferior — the exam prefers the split.
  • D — Unrelated.

3

An agent has a well-described verify_fact tool but consistently uses web_search instead. Descriptions are clear and non-overlapping. What should be audited next?

  • A. The system prompt, for keyword-sensitive instructions steering the model toward search.
  • B. The verify_fact tool's output schema.
  • C. Whether verify_fact appears before web_search in the tools array.
  • D. The model's temperature setting.
Answer

A.

When descriptions are sound, the next place selection pressure comes from is the system prompt. An instruction like "always search for current information" will pull the model to web_search regardless of the tool descriptions.

  • B — Output schema doesn't affect selection.
  • C — Tool order is not a documented selection mechanism; treating it as one is a distractor.
  • D — Temperature affects variability, not systematic misrouting.

4

After a team grew an agent's tool count from 5 to 18, selection accuracy dropped noticeably. Which two responses are appropriate? (Select two.)

  • A. Consolidate overlapping tools and remove ones that are rarely used.
  • B. Scope tools per agent so each has only what its role requires.
  • C. Add a system prompt section listing all 18 tools and when to use each.
  • D. Force tool_choice: "any" so the model always commits to a tool.
Answer

A and B.

Both reduce the candidate set the model must discriminate across. The exam's figure: 18 tools instead of 4–5 degrades selection.

  • C — Duplicates the descriptions in a less effective location and adds context on every call.
  • D — Forces tool use without improving which tool. If anything it removes the option of not calling a tool.

5

Analysis shows 85% of analyze_document calls are a single narrow task: checking whether a specific claim is supported by a source. The remaining 15% vary. Best design?

  • A. Add a scoped verify_claim_against_source tool for the common case and keep the general tool for the rest.
  • B. Keep the single general tool and improve its description.
  • C. Replace the general tool entirely with the scoped one.
  • D. Add a task_type enum to the general tool.
Answer

A.

Scope the common case; keep a route for the exception. The 85% gets a purpose-built tool with a precise schema, and nothing is lost.

  • B — Leaves the dominant case served by a general-purpose tool that's easy to misuse.
  • C — Drops 15% of capability. Over-correction.
  • D — Better than nothing but keeps one tool with a diffuse description.

6

Agents pass arbitrary, sometimes malformed URLs to a fetch_url tool and receive unusable content. What is the appropriate change?

  • A. Replace fetch_url with a load_document tool that validates and normalizes its input and returns structured content.
  • B. Add a prompt instruction to only pass well-formed URLs.
  • C. Add retry logic to fetch_url.
  • D. Return an empty result when the URL is malformed.
Answer

A.

Move validation into the tool. The tool boundary is the deterministic place to enforce input shape and return something usable.

  • B — Probabilistic guidance for an input-validation problem.
  • C — Retrying a malformed URL fails identically.
  • D — Reports a validation failure as "nothing found." Reflex 6 violation.

7

Which tool_choice setting forces the model to call one specific tool?

  • A. "auto"
  • B. "any"
  • C. {"type": "tool", "name": "extract_invoice"}
  • D. {"type": "forced", "tool": "extract_invoice"}
Answer

C.

  • A — Model decides whether to use a tool at all.
  • B — Must use some tool, its choice which.
  • D — Not a real form.

8

Which elements belong in a tool description to support correct selection? (Select three.)

  • A. Accepted input formats and required prefixes.
  • B. Example queries the tool is appropriate for.
  • C. Explicit boundaries — what the tool does not handle, and which tool does.
  • D. The tool's average latency and cost per call.
Answer

A, B, and C.

  • D — Performance characteristics aren't selection information in the exam's framing, and performance benchmarking is out of scope.

9

Each subagent in a multi-agent system is given the full set of twelve tools "for flexibility." Which two problems does this create? (Select two.)

  • A. Reduced tool-selection accuracy within each subagent.
  • B. Violation of least privilege — subagents can take actions outside their role.
  • C. Increased likelihood of subagents communicating directly with each other.
  • D. Higher latency on tool discovery at connection time.
Answer

A and B.

More candidates means more misrouting, and a research subagent holding process_refund can do things it should never do.

  • C — Tool access doesn't create a communication channel; topology is a separate concern.
  • D — Not a documented consequence and not what the exam tests.

10

An MCP-provided search_codebase tool is consistently ignored in favour of the built-in Grep, even where search_codebase would be better. What is the fix?

  • A. Enhance the MCP tool's description to state explicitly what it does that Grep cannot.
  • B. Remove Grep from the agent's allowed tools.
  • C. Set the MCP tool as preferred in .mcp.json.
  • D. Add the MCP tool twice so it appears more prominent.
Answer

A.

Selection is description-driven. If search_codebase offers semantic matching or cross-repository scope, the description has to say so.

  • B — Removing a genuinely useful built-in to force selection. Over-correction, and Grep remains the right tool for literal searches.
  • C — No such option exists.
  • D — Not a mechanism.

Block B — MCP, errors, built-ins (items 11–20)

11

A team wants all developers on a repository to share the same MCP server configuration, including one that needs an API token. What is correct?

  • A. Commit .mcp.json at the repo root with the token referenced as ${JIRA_API_TOKEN}.
  • B. Commit .mcp.json with the token value inline, and restrict repository access.
  • C. Have each developer add the server to ~/.claude.json.
  • D. Commit ~/.claude.json to the repository.
Answer

A.

.mcp.json is the project-level, committed configuration. ${ENV_VAR} expansion lets you share the config without sharing the secret.

  • B — Commits a credential. Never correct.
  • C — Works but isn't shared — every developer configures it manually, and it drifts.
  • D — ~/.claude.json is user-level and outside the repository; it also holds unrelated personal config.

12

A document-search tool returns [] with isError: false when the caller lacks permission on a collection. The final research report states that no internal documents exist on the topic. What is wrong?

  • A. The synthesis agent should have verified the claim before including it.
  • B. The tool reports an access failure as a valid empty result; it should return isError: true with a permission category.
  • C. The coordinator should have retried the search.
  • D. The report should have included a confidence score for the claim.
Answer

B.

An access failure is not a valid empty result. Because the tool reported success, nothing downstream could know the difference between "we looked and found nothing" and "we couldn't look."

  • A — Downstream verification can't recover information the tool concealed.
  • C — Retrying a permission failure fails identically — and the agent doesn't know there was a failure.
  • D — A confidence score on a false premise is still false.

Reflex 6. This is the highest-value item in the domain.

13

Which error categories should be marked non-retryable? (Select two.)

  • A. transient
  • B. validation
  • C. business
  • D. permission
Answer

C and D.

Business-rule violations and permission denials do not change on retry.

  • A — Retryable by definition.
  • B — Retryable after correcting the input — the model can fix a malformed ID and try again. Not in the same class as C and D.

14

A refund is requested for an order shipped 139 days ago; policy allows 90. What should the tool return?

  • A. isError: true, errorCategory: "business", isRetryable: false, with the reason and the escalation alternative.
  • B. isError: true, errorCategory: "validation", isRetryable: true.
  • C. isError: false with a message explaining the policy.
  • D. isError: true with a generic "refund not permitted" message.
Answer

A.

Category, retryability, a specific reason, and an alternative — the four elements of structured error context. The agent can then explain the situation and route to escalation.

  • B — Misclassified. The input was valid; the policy prohibits the action. Marking it retryable wastes turns.
  • C — A failure reported as success.
  • D — Correct flag, useless payload. The agent can't tell whether to retry or what to do instead.

15

A research subagent cannot access one of four document collections. Three succeed. What should it return to the coordinator?

  • A. The three successful result sets, plus a structured error describing the fourth: category, what was attempted, and suggested alternatives.
  • B. A generic "search unavailable" error, so the coordinator knows something failed.
  • C. Only the three successful result sets, since partial success is still success.
  • D. An error that terminates the research workflow.
Answer

A.

Recover what you can locally, propagate what you can't with partial results attached.

  • B — Hides category, retryability, scope, and what succeeded.
  • C — Silent suppression. The coordinator builds a report with an undisclosed gap.
  • D — Terminating on one component's failure discards three successful streams. The symmetric anti-pattern.

16

Find every React component test file in a repository. Which tool?

  • A. Glob with **/*.test.tsx
  • B. Grep for describe(
  • C. Read on the test directory
  • D. Bash with find . -name "*.test.tsx"
Answer

A.

Glob matches file paths. This is exactly its job.

  • B — Grep searches contents; it would miss files using a different test idiom and match non-test files that contain the string.
  • C — Read operates on files, and tests aren't confined to one directory.
  • D — Works, but reaching for Bash when a purpose-built tool exists is the wrong instinct — and the exam tests the Grep/Glob distinction directly.

17

An agent needs to change a variable name that appears four times in a file. Which approach?

  • A. Edit with the variable name as the anchor.
  • B. Read the file, then Write the full updated contents.
  • C. Grep then Edit.
  • D. Bash with sed -i.
Answer

B.

Edit requires a unique anchor. Four occurrences means no unique anchor, so Read + Write is correct.

  • A — Fails or edits the wrong occurrence.
  • C — Grep locates it; the edit still has no unique anchor.
  • D — Bypasses the file tools with an unreviewable in-place mutation.

18

An agent must understand an unfamiliar 200-file codebase to plan a refactor. Most efficient approach?

  • A. Read every file to build a complete picture.
  • B. Grep for entry points, then Read selectively to follow the imports.
  • C. Glob for all source files and Read the twenty largest.
  • D. Ask the model to describe the typical structure of this kind of application.
Answer

B.

Targeted discovery. Entry points anchor the structure; following imports traverses only what matters.

  • A — Fills context with irrelevant files and causes context degradation.
  • C — File size is a poor proxy for importance.
  • D — This is the context-degradation failure mode: generic patterns instead of the actual code.

19

A team needs Jira integration for their agent. What does the exam prefer?

  • A. Use an existing community MCP server for Jira.
  • B. Build a custom MCP server wrapping the Jira REST API.
  • C. Give the agent Bash access and let it call curl.
  • D. Deploy a self-hosted MCP gateway in front of Jira.
Answer

A.

Standard third-party integrations → community MCP servers. Build custom only for your own internal systems.

  • B — Unnecessary work for a solved problem.
  • C — No schema, no descriptions, no error semantics. Loses everything MCP provides.
  • D — Infrastructure. Deploying and hosting MCP servers is explicitly out of scope.

20

When are tools from an MCP server discovered, and how are they available afterwards?

  • A. Discovered at connection time; all discovered tools are then simultaneously available.
  • B. Discovered on first use; each must be enabled individually.
  • C. Discovered per request, based on the prompt's content.
  • D. Discovered at connection time, but only the first ten are loaded.
Answer

A.

  • B, C, D — All invent mechanisms. D in particular attaches a fake limit to a true first clause — a common distractor shape.

Scoring

Score Read
18–20 Strong.
15–17 Solid; re-read Chapter 06 on the misses.
11–14 Re-read Chapters 05–06 fully.
< 11 Re-study before moving on. Items 12 and 15 in particular carry the domain's central ideas.